[bug #64187] Memory repeated freed

[anonymous]

URL:
  <https://savannah.gnu.org/bugs/?64187>

                 Summary: Memory repeated freed
                   Group: GNU FreeIPMI
               Submitter: None
               Submitted: Fri 12 May 2023 09:26:17 AM UTC
                Category: ipmi-sel
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Crash
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: GNU/Linux


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Fri 12 May 2023 09:26:17 AM UTC By: Anonymous
first:
_ipmiseld_poll(void *arg) in ipmiseld.c called two functions:
one is ipmi_sdr_ctx_destroy()
another is ipmiseld_sdr_cache_create_and_load()

second:
ipmiseld_sdr_cache_and_load() in ipmiseld-cache.c. also called fuction
ipmi_sdr_ctx_destroy()

Imagine a scenario:
_ipmiseld_poll called ipmiseld_sdr_cache_and_load() and
ipmiseld_sdr_cache_and_load execution faild, then ipme_sdr_ctx_destroy() will
be called first in ipmiseld_sdr_cache_and_load then _ipmiseld_poll will goto
cleanup,ipme_sdr_ctx_destroy will be execute twice.

This hidden danger triggered service failed in some Linux System, and fixed up
in openEuler : https://gitee.com/src-openeuler/freeipmi/pulls/20







    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?64187>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/