From 033295c188bfba28b693fb9da789678503c335c7 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 20 Feb 2019 11:32:29 +0900 Subject: [PATCH] network: fix invalid memory access This fixes a bug introduced by 959f65d32ec15cf84afe3efff1a18b0987b56c60. --- src/network/networkd-link.c | 8 +++++++- src/network/networkd-manager.c | 6 +++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c index e6a1cfd5d2..f894bb5c58 100644 --- a/src/network/networkd-link.c +++ b/src/network/networkd-link.c @@ -592,8 +592,8 @@ static void link_detach_from_manager(Link *link) { } static Link *link_free(Link *link) { + Link *carrier, *master; Address *address; - Link *carrier; Route *route; Iterator i; @@ -661,6 +661,12 @@ static Link *link_free(Link *link) { hashmap_free(link->bond_slaves); + if (link->network) { + if (link->network->bond && + link_get(link->manager, link->network->bond->ifindex, &master) >= 0) + (void) hashmap_remove(master->bond_slaves, INT_TO_PTR(link->ifindex)); + } + return mfree(link); } diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c index 8eb6e86c33..00f6545e24 100644 --- a/src/network/networkd-manager.c +++ b/src/network/networkd-manager.c @@ -1427,9 +1427,6 @@ void manager_free(Manager *m) { sd_netlink_unref(m->genl); sd_resolve_unref(m->resolve); - while ((network = m->networks)) - network_free(network); - while ((link = hashmap_first(m->dhcp6_prefixes))) manager_dhcp6_prefix_remove_all(m, link); hashmap_free(m->dhcp6_prefixes); @@ -1445,6 +1442,9 @@ void manager_free(Manager *m) { m->links_requesting_uuid = set_free(m->links_requesting_uuid); set_free(m->duids_requesting_uuid); + while ((network = m->networks)) + network_free(network); + hashmap_free(m->networks_by_name); m->netdevs = hashmap_free_with_destructor(m->netdevs, netdev_unref);