On 5/15/24 17:52, Simon Horman wrote:
> On Wed, May 15, 2024 at 02:14:13PM +0800, Yunjian Wang via dev wrote:
>> From: Pengfei Sun <[email protected]>
>>
>> In function shash_replace_nocopy, argument to free() is the address
>> of a global variable (argument passed by function table_print_json__),
>> which is not memory allocated by malloc().
>>
>> ovsdb-client -f json monitor Open_vSwitch --timestamp
>>
>> ASan reports:
>> =================================================================
>> ==1443083==ERROR: AddressSanitizer: attempting free on address
>> which was not malloc()-ed: 0x000000535980 in thread T0
>>     #0 0xffffaf1c9eac in __interceptor_free (/usr/lib64/libasan.so.6+
>> 0xa4eac)
>>     #1 0x4826e4 in json_destroy_object lib/json.c:445
>>     #2 0x4826e4 in json_destroy__ lib/json.c:403
>>     #3 0x4cc4e4 in table_print lib/table.c:633
>>     #4 0x410650 in monitor_print_table ovsdb/ovsdb-client.c:1019
>>     #5 0x410650 in monitor_print ovsdb/ovsdb-client.c:1040
>>     #6 0x4110cc in monitor_print ovsdb/ovsdb-client.c:1030
>>     #7 0x4110cc in do_monitor__ ovsdb/ovsdb-client.c:1503
>>     #8 0x40743c in main ovsdb/ovsdb-client.c:283
>>     #9 0xffffaeb50038  (/usr/lib64/libc.so.6+0x2b038)
>>     #10 0xffffaeb50110 in __libc_start_main (/usr/lib64/libc.so.6+
>> 0x2b110)
>>     #11 0x40906c in _start (/usr/local/bin/ovsdb-client+0x40906c)
>>
>> Fixes: cb139fa8b3a1 ("table: New function table_format() for formatting a 
>> table as a string.")
>> Signed-off-by: Pengfei Sun <[email protected]>
> 
> Acked-by: Simon Horman <[email protected]>
> 

Thanks, Pengfei, Eelco and Simon!

Applied and backpotred down to 2.17.

Best regards, Ilya Maximets.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to