[rdma-core patch] srp_daemon: fix a double free segment fault for ibsrpdm

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Honggang Li <honli@xxxxxxxxxx>

Command: ./ibsrpdm -d /dev/infiniband/umadX

Invalid free() / delete / delete[] / realloc()
   at 0x4C320DC: free (vg_replace_malloc.c:540)
   by 0x403BBB: free_config (srp_daemon.c:1811)
   by 0x4031BE: ibsrpdm (srp_daemon.c:2113)
   by 0x4031BE: main (srp_daemon.c:2153)
 Address 0x5ee5fd0 is 0 bytes inside a block of size 16 free'd
   at 0x4C320DC: free (vg_replace_malloc.c:540)
   by 0x404851: translate_umad_to_ibdev_and_port (srp_daemon.c:729)
   by 0x404851: set_conf_dev_and_port (srp_daemon.c:1586)
   by 0x403171: ibsrpdm (srp_daemon.c:2092)
   by 0x403171: main (srp_daemon.c:2153)
 Block was alloc'd at
   at 0x4C30EDB: malloc (vg_replace_malloc.c:309)
   by 0x40478D: translate_umad_to_ibdev_and_port (srp_daemon.c:698)
   by 0x40478D: set_conf_dev_and_port (srp_daemon.c:1586)
   by 0x403171: ibsrpdm (srp_daemon.c:2092)
   by 0x403171: main (srp_daemon.c:2153)

Signed-off-by: Honggang Li <honli@xxxxxxxxxx>
---
 srp_daemon/srp_daemon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/srp_daemon/srp_daemon.c b/srp_daemon/srp_daemon.c
index 337b21c7..f0bcf923 100644
--- a/srp_daemon/srp_daemon.c
+++ b/srp_daemon/srp_daemon.c
@@ -727,6 +727,7 @@ end:
 	if (ret) {
 		free(*ibport);
 		free(*ibdev);
+		*ibdev = NULL;
 	}
 	free(class_dev_path);
 
-- 
2.21.0




[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux