From: Peter Maydell <[email protected]> In of_dpa_cmd_add_l2_flood(), we allocate memory for the group->l2_flood.group_ids array, freeing any previous array. However, in the error-exit path we free the group_ids memory but do not clear the pointer to NULL. This means that if the guest causes us to take the error-exit path and then later call the function again, we will try again to free the memory we already freed.
Fix this by clearing the group_ids pointer in the error exit path, so we maintain the invariant of "either it points at allocated memory, or it is NULL" (both being valid to g_free()). Cc: [email protected] Fixes: dc488f88806 ("rocker: add new rocker switch device") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3253 Signed-off-by: Peter Maydell <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Message-id: [email protected] (cherry picked from commit a0721c099b71f7bdfafa2675daee331d884163d2) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c index 3378f63110..b4da3cc0ec 100644 --- a/hw/net/rocker/rocker_of_dpa.c +++ b/hw/net/rocker/rocker_of_dpa.c @@ -2063,6 +2063,7 @@ static int of_dpa_cmd_add_l2_flood(OfDpa *of_dpa, OfDpaGroup *group, err_out: group->l2_flood.group_count = 0; g_free(group->l2_flood.group_ids); + group->l2_flood.group_ids = NULL; g_free(tlvs); return err; -- 2.47.3
