Skip to content
Snippets Groups Projects
  • Zhang Chen's avatar
    a18d4369
    net/colo: Fix a "double free" crash to clear the conn_list · a18d4369
    Zhang Chen authored
    
    We notice the QEMU may crash when the guest has too many
    incoming network connections with the following log:
    
    15197@1593578622.668573:colo_proxy_main : colo proxy connection hashtable full, clear it
    free(): invalid pointer
    [1]    15195 abort (core dumped)  qemu-system-x86_64 ....
    
    This is because we create the s->connection_track_table with
    g_hash_table_new_full() which is defined as:
    
    GHashTable * g_hash_table_new_full (GHashFunc hash_func,
                           GEqualFunc key_equal_func,
                           GDestroyNotify key_destroy_func,
                           GDestroyNotify value_destroy_func);
    
    The fourth parameter connection_destroy() will be called to free the
    memory allocated for all 'Connection' values in the hashtable when
    we call g_hash_table_remove_all() in the connection_hashtable_reset().
    
    But both connection_track_table and conn_list reference to the same
    conn instance. It will trigger double free in conn_list clear. So this
    patch remove free action on hash table side to avoid double free the
    conn.
    
    Signed-off-by: default avatarLike Xu <like.xu@linux.intel.com>
    Signed-off-by: default avatarZhang Chen <chen.zhang@intel.com>
    Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
    a18d4369
    History
    net/colo: Fix a "double free" crash to clear the conn_list
    Zhang Chen authored
    
    We notice the QEMU may crash when the guest has too many
    incoming network connections with the following log:
    
    15197@1593578622.668573:colo_proxy_main : colo proxy connection hashtable full, clear it
    free(): invalid pointer
    [1]    15195 abort (core dumped)  qemu-system-x86_64 ....
    
    This is because we create the s->connection_track_table with
    g_hash_table_new_full() which is defined as:
    
    GHashTable * g_hash_table_new_full (GHashFunc hash_func,
                           GEqualFunc key_equal_func,
                           GDestroyNotify key_destroy_func,
                           GDestroyNotify value_destroy_func);
    
    The fourth parameter connection_destroy() will be called to free the
    memory allocated for all 'Connection' values in the hashtable when
    we call g_hash_table_remove_all() in the connection_hashtable_reset().
    
    But both connection_track_table and conn_list reference to the same
    conn instance. It will trigger double free in conn_list clear. So this
    patch remove free action on hash table side to avoid double free the
    conn.
    
    Signed-off-by: default avatarLike Xu <like.xu@linux.intel.com>
    Signed-off-by: default avatarZhang Chen <chen.zhang@intel.com>
    Signed-off-by: default avatarJason Wang <jasowang@redhat.com>