[ovs-dev] [PATCH 2/5] ovsdb: Fix double-free in ovsdb_jsonrpc_session_close().

Ethan Jackson ethan at nicira.com
Thu Jan 24 19:50:35 UTC 2013


Acked-by: Ethan Jackson <ethan at nicira.com>

On Thu, Jan 24, 2013 at 11:47 AM, Ben Pfaff <blp at nicira.com> wrote:
> ovsdb_session_destroy() was called twice but it should only be called once.
>
> This double-free is unlikely to cause problems in practice because it only
> triggers if there were ever more than two outstanding requests in the
> session at a time (because the only data being freed is an hmap, which
> does not allocate any heap memory unless the hmap has more than two
> elements).
>
> Signed-off-by: Ben Pfaff <blp at nicira.com>
> ---
>  ovsdb/jsonrpc-server.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c
> index 1d0b0e3..6d07c45 100644
> --- a/ovsdb/jsonrpc-server.c
> +++ b/ovsdb/jsonrpc-server.c
> @@ -1,4 +1,4 @@
> -/* Copyright (c) 2009, 2010, 2011, 2012 Nicira, Inc.
> +/* Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc.
>   *
>   * Licensed under the Apache License, Version 2.0 (the "License");
>   * you may not use this file except in compliance with the License.
> @@ -386,7 +386,6 @@ ovsdb_jsonrpc_session_close(struct ovsdb_jsonrpc_session *s)
>      ovsdb_jsonrpc_session_unlock_all(s);
>      jsonrpc_session_close(s->js);
>      list_remove(&s->node);
> -    ovsdb_session_destroy(&s->up);
>      s->remote->server->n_sessions--;
>      ovsdb_session_destroy(&s->up);
>      free(s);
> --
> 1.7.2.5
>
> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> http://openvswitch.org/mailman/listinfo/dev



More information about the dev mailing list