[v1] chardev/tcp: fix error message double free error

[PATCH] chardev/tcp: fix error message double free error

lichun posted 1 patch 3 years, 10 months ago

Diff against v2
Download mbox

Test FreeBSD passed

Test asan passed

Test docker-quick@centos7 passed

Test checkpatch passed

Test docker-mingw@fedora passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20200621145303.13068-1-lichun@ruijie.com.cn

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, "Marc-André Lureau" <marcandre.lureau@redhat.com>

There is a newer version of this series

chardev/char-socket.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH] chardev/tcp: fix error message double free error

Posted by lichun 3 years, 10 months ago

Signed-off-by: lichun <lichun@ruijie.com.cn>
---
 chardev/char-socket.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index afebeec5c3..3b6c1c5848 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1086,7 +1086,10 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
     if (qio_task_propagate_error(task, &err)) {
         tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
         check_report_connect_error(chr, err);
-        error_free(err);
+        /* If connect_err_reported is true, it means err is already freed */
+        if (!s->connect_err_reported) {
+            error_free(err);
+        }
         goto cleanup;
     }
 
-- 
2.18.4

Re: [PATCH] chardev/tcp: fix error message double free error

Posted by Marc-André Lureau 3 years, 10 months ago

Hi

On Sun, Jun 21, 2020 at 10:54 AM lichun <lichun@ruijie.com.cn> wrote:
>
> Signed-off-by: lichun <lichun@ruijie.com.cn>
> ---
>  chardev/char-socket.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> index afebeec5c3..3b6c1c5848 100644
> --- a/chardev/char-socket.c
> +++ b/chardev/char-socket.c
> @@ -1086,7 +1086,10 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
>      if (qio_task_propagate_error(task, &err)) {
>          tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
>          check_report_connect_error(chr, err);
> -        error_free(err);
> +        /* If connect_err_reported is true, it means err is already freed */
> +        if (!s->connect_err_reported) {
> +            error_free(err);
> +        }

Good catch (did you find it with a static analysis tool?).

Instead of checking connect_err_reported here, I would rather let
check_report_connect_error() handle error_free(). Can you update the
patch?

thanks

>          goto cleanup;
>      }
>
> --
> 2.18.4
>