Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <f9ac4cc1-8548-c4d7-ece8-214933a56808@redhat.com>
Date:   Mon, 7 Aug 2023 07:16:13 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [Libtirpc-devel] [PATCH 2/2] rpcb_clnt.c: Eliminate double frees
 in delete_cache()
Content-Language: en-US
From:   Steve Dickson <steved@redhat.com>
To:     Libtirpc-devel Mailing List <libtirpc-devel@lists.sourceforge.net>
Cc:     Linux NFS Mailing list <linux-nfs@vger.kernel.org>
References: <20230801144209.557175-1-steved@redhat.com>
 <20230801144209.557175-2-steved@redhat.com>
In-Reply-To: <20230801144209.557175-2-steved@redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 8/1/23 10:42 AM, Steve Dickson wrote:
> From: Herb Wartens <wartens2@llnl.gov>
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224666
> Signed-off-by: Steve Dickson <steved@redhat.com>
Committed... (tag: libtirpc-1-3-4-rc2)

steved
> ---
>   src/rpcb_clnt.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/src/rpcb_clnt.c b/src/rpcb_clnt.c
> index c0a9e12..68fe69a 100644
> --- a/src/rpcb_clnt.c
> +++ b/src/rpcb_clnt.c
> @@ -262,12 +262,15 @@ delete_cache(addr)
>   	for (cptr = front; cptr != NULL; cptr = cptr->ac_next) {
>   		if (!memcmp(cptr->ac_taddr->buf, addr->buf, addr->len)) {
>   			/* Unlink from cache. We'll destroy it after releasing the mutex. */
> -			if (cptr->ac_uaddr)
> +			if (cptr->ac_uaddr) {
>   				free(cptr->ac_uaddr);
> -			if (prevptr)
> +				cptr->ac_uaddr = NULL;
> +			}
> +			if (prevptr) {
>   				prevptr->ac_next = cptr->ac_next;
> -			else
> +			} else {
>   				front = cptr->ac_next;
> +			}
>   			cachesize--;
>   			break;
>   		}