diff options
| author | Jukka Rissanen <jukka.rissanen@linux.intel.com> | 2011-11-25 17:05:37 +0200 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2011-11-28 17:55:13 +0100 |
| commit | ee29e7046e205e1e2eb3bab6f608c5cac8a6bf3a (patch) | |
| tree | 0d12e6f293da0d75a1908fe028449d22bb8fac1d | |
| parent | d436afd59968222b29e6fad922c2f0941d2a79f3 (diff) | |
| download | connman-ee29e7046e205e1e2eb3bab6f608c5cac8a6bf3a.tar.gz connman-ee29e7046e205e1e2eb3bab6f608c5cac8a6bf3a.tar.bz2 connman-ee29e7046e205e1e2eb3bab6f608c5cac8a6bf3a.zip | |
ipconfig: Remove ipconfig from ipconfig_list
It is possible that ipdevice does not contain ipconfig for
some reason. If that happens, then ipconfig is not removed
from ipconfig_list which will then escalate into freed memory
access when interface is taken down.
The problem was seen with valgrind when tethering was enabled
and then disabled for wifi.
| -rw-r--r-- | src/ipconfig.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/ipconfig.c b/src/ipconfig.c index b4729903..f817699f 100644 --- a/src/ipconfig.c +++ b/src/ipconfig.c @@ -1330,7 +1330,8 @@ void connman_ipconfig_unref(struct connman_ipconfig *ipconfig) if (__sync_fetch_and_sub(&ipconfig->refcount, 1) != 1) return; - __connman_ipconfig_disable(ipconfig); + if (__connman_ipconfig_disable(ipconfig) < 0) + ipconfig_list = g_list_remove(ipconfig_list, ipconfig); connman_ipconfig_set_ops(ipconfig, NULL); |