> On Sat, 4 May 2019 15:26:25 +0800 > Zhiqiang Liu <[email protected]> wrote: > >> From: Zhiqiang Liu <[email protected]> >> >> Follow the following steps: >> # ip netns add net1 >> # export MALLOC_MMAP_THRESHOLD_=0 >> # ip netns list >> then Segmentation fault (core dumped) will occur. >> >> In get_netnsid_from_name func, answer is freed before >> rta_getattr_u32(tb[NETNSA_NSID]), >> where tb[] refers to answer`s content. If we set MALLOC_MMAP_THRESHOLD_=0, >> mmap will >> be adoped to malloc memory, which will be freed immediately after calling >> free func. >> So reading tb[NETNSA_NSID] will access the released memory after >> free(answer). >> >> Here, we will call get_netnsid_from_name(tb[NETNSA_NSID]) before >> free(answer). >> >> Fixes: 86bf43c7c2f ("lib/libnetlink: update rtnl_talk to support malloc buff >> at run time") >> Reported-by: Huiying Kou <[email protected]> >> Signed-off-by: Zhiqiang Liu <[email protected]> >> Acked-by: Phil Sutter <[email protected]> > > Applied. You can get better and more detailed checks by running with > valgrind. Which is what I did after applying your patch.
Thank you for your advice. I will learn how to use valgrind, and use it to obtain more detailed checks. > > . >
