From patchwork Fri Nov 20 18:13:10 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark McLoughlin X-Patchwork-Id: 38934 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 07F38B6F19 for ; Sat, 21 Nov 2009 05:16:33 +1100 (EST) Received: from localhost ([127.0.0.1]:59789 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NBY21-00069H-SV for incoming@patchwork.ozlabs.org; Fri, 20 Nov 2009 13:16:29 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NBY1X-00068X-4d for qemu-devel@nongnu.org; Fri, 20 Nov 2009 13:15:59 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NBY1S-00067I-K8 for qemu-devel@nongnu.org; Fri, 20 Nov 2009 13:15:58 -0500 Received: from [199.232.76.173] (port=41984 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NBY1S-00067E-HI for qemu-devel@nongnu.org; Fri, 20 Nov 2009 13:15:54 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47513) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NBY1R-0005mG-Jg for qemu-devel@nongnu.org; Fri, 20 Nov 2009 13:15:54 -0500 Received: from int-mx05.intmail.prod.int.phx2.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.18]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id nAKIFnYs012179 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 20 Nov 2009 13:15:49 -0500 Received: from blaa.localdomain (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx05.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id nAKIFmVV026459; Fri, 20 Nov 2009 13:15:49 -0500 Received: by blaa.localdomain (Postfix, from userid 500) id 409444B92; Fri, 20 Nov 2009 18:13:11 +0000 (GMT) From: Mark McLoughlin To: qemu-devel@nongnu.org Date: Fri, 20 Nov 2009 18:13:10 +0000 Message-Id: <1258740790-26036-1-git-send-email-markmc@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.18 X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Cc: Mark McLoughlin , Jan Kiszka Subject: [Qemu-devel] [PATCH] slirp: fix use-after-free X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org 460fec67ee introduced a use-after free in slirp. Cc: Jan Kiszka Signed-off-by: Mark McLoughlin --- Untested fix, but it's obvious. Also, this is needed on stable-0.11. slirp/mbuf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/slirp/mbuf.c b/slirp/mbuf.c index 7652fea..87508ba 100644 --- a/slirp/mbuf.c +++ b/slirp/mbuf.c @@ -95,8 +95,8 @@ m_free(struct mbuf *m) * Either free() it or put it on the free list */ if (m->m_flags & M_DOFREE) { - free(m); m->slirp->mbuf_alloced--; + free(m); } else if ((m->m_flags & M_FREELIST) == 0) { insque(m,&m->slirp->m_freelist); m->m_flags = M_FREELIST; /* Clobber other flags */