[libvirt] [PATCH] stream: avoid use-after-free
virFDStreamClose used a mutex after it was freed, and failed
to destroy that mutex on its last use.
* src/fdstream.c (virFDStreamFree): Inline into sole caller...
(virFDStreamClose): ...to avoid use-after-free and leak.
Reported by Matthias Bolte.
---
src/fdstream.c | 34 ++++++++++++++--------------------
1 files changed, 14 insertions(+), 20 deletions(-)
diff --git a/src/fdstream.c b/src/fdstream.c
index 2702ad7..e19694f 100644
--- a/src/fdstream.c
+++ b/src/fdstream.c
@@ -210,9 +210,20 @@ cleanup:
return ret;
}
-static int virFDStreamFree(struct virFDStreamData *fdst)
+
+static int
+virFDStreamClose(virStreamPtr st)
{
+ struct virFDStreamData *fdst = st->privateData;
int ret;
+
+ VIR_DEBUG("st=%p", st);
+
+ if (!fdst)
+ return 0;
+
+ virMutexLock(&fdst->lock);
+
ret = VIR_CLOSE(fdst->fd);
if (fdst->cmd) {
char buf[1024];
@@ -243,29 +254,12 @@ static int virFDStreamFree(struct virFDStreamData *fdst)
}
virCommandFree(fdst->cmd);
}
- VIR_FREE(fdst);
- return ret;
-}
-
-
-static int
-virFDStreamClose(virStreamPtr st)
-{
- struct virFDStreamData *fdst = st->privateData;
- int ret;
-
- VIR_DEBUG("st=%p", st);
-
- if (!fdst)
- return 0;
-
- virMutexLock(&fdst->lock);
-
- ret = virFDStreamFree(fdst);
st->privateData = NULL;
virMutexUnlock(&fdst->lock);
+ virMutexDestroy(&fdst->lock);
+ VIR_FREE(fdst);
return ret;
}
--
1.7.4.4