URL:
<https://savannah.gnu.org/bugs/?64187>
Summary: Memory repeated freed
Group: GNU FreeIPMI
Submitter: None
Submitted: Fri 12 May 2023 09:26:17 AM UTC
Category: ipmi-sel
Severity: 3 - Normal
Priority: 5 - Normal
Item Group: Crash
Status: None
Privacy: Public
Assigned to: None
Open/Closed: Open
Discussion Lock: Any
Operating System: GNU/Linux
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: Fri 12 May 2023 09:26:17 AM UTC By: Anonymous
first:
_ipmiseld_poll(void *arg) in ipmiseld.c called two functions:
one is ipmi_sdr_ctx_destroy()
another is ipmiseld_sdr_cache_create_and_load()
second:
ipmiseld_sdr_cache_and_load() in ipmiseld-cache.c. also called fuction
ipmi_sdr_ctx_destroy()
Imagine a scenario:
_ipmiseld_poll called ipmiseld_sdr_cache_and_load() and
ipmiseld_sdr_cache_and_load execution faild, then ipme_sdr_ctx_destroy() will
be called first in ipmiseld_sdr_cache_and_load then _ipmiseld_poll will goto
cleanup,ipme_sdr_ctx_destroy will be execute twice.
This hidden danger triggered service failed in some Linux System, and fixed up
in openEuler : https://gitee.com/src-openeuler/freeipmi/pulls/20
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?64187>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
