The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxc/pull/1106
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
This fixes a double free corruption on container-requested
reboots when lxc_spawn() fails before receiving the ttys, as
lxc_fini() (part of __lxc_start()'s cleanup) calls
lxc_delete_tty().
Signed-off-by: Wolfgang Bumiller <w.bumil...@proxmox.com>
From e00c024230e457a0f37ea5c90bd8caac0c30020e Mon Sep 17 00:00:00 2001
From: Wolfgang Bumiller <w.bumil...@proxmox.com>
Date: Thu, 28 Jul 2016 11:52:18 +0200
Subject: [PATCH] conf: set pty_info to NULL after free
This fixes a double free corruption on container-requested
reboots when lxc_spawn() fails before receiving the ttys, as
lxc_fini() (part of __lxc_start()'s cleanup) calls
lxc_delete_tty().
Signed-off-by: Wolfgang Bumiller <w.bumil...@proxmox.com>
---
src/lxc/conf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 48a2978..1e330ac 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3327,6 +3327,7 @@ void lxc_delete_tty(struct lxc_tty_info *tty_info)
}
free(tty_info->pty_info);
+ tty_info->pty_info = NULL;
tty_info->nbtty = 0;
}
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
