On Sat, 4 May 2019 15:26:25 +0800 Zhiqiang Liu <[email protected]> wrote:
> From: Zhiqiang Liu <[email protected]> > > Follow the following steps: > # ip netns add net1 > # export MALLOC_MMAP_THRESHOLD_=0 > # ip netns list > then Segmentation fault (core dumped) will occur. > > In get_netnsid_from_name func, answer is freed before > rta_getattr_u32(tb[NETNSA_NSID]), > where tb[] refers to answer`s content. If we set MALLOC_MMAP_THRESHOLD_=0, > mmap will > be adoped to malloc memory, which will be freed immediately after calling > free func. > So reading tb[NETNSA_NSID] will access the released memory after free(answer). > > Here, we will call get_netnsid_from_name(tb[NETNSA_NSID]) before free(answer). > > Fixes: 86bf43c7c2f ("lib/libnetlink: update rtnl_talk to support malloc buff > at run time") > Reported-by: Huiying Kou <[email protected]> > Signed-off-by: Zhiqiang Liu <[email protected]> > Acked-by: Phil Sutter <[email protected]> Applied. You can get better and more detailed checks by running with valgrind. Which is what I did after applying your patch.
