[lxc-devel] [lxc/master] cgfs: fix invalid free()

[brauner on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 448 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20161029/1ca68b4c/attachment.bin>
-------------- next part --------------
From 2446c321cf1da4ee5077d5dd4e6147932607e993 Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner at canonical.com>
Date: Sat, 29 Oct 2016 22:47:51 +0200
Subject: [PATCH] cgfs: fix invalid free()

And let's be on the safe side by NULLing free()ed variables.

Signed-off-by: Christian Brauner <christian.brauner at canonical.com>
---
 src/lxc/cgroups/cgfs.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c
index c5ba765..26cccad 100644
--- a/src/lxc/cgroups/cgfs.c
+++ b/src/lxc/cgroups/cgfs.c
@@ -632,10 +632,10 @@ static struct cgroup_meta_data *lxc_cgroup_put_meta(struct cgroup_meta_data *met
 	if (--meta_data->ref > 0)
 		return meta_data;
 	lxc_free_array((void **)meta_data->mount_points, (lxc_free_fn)lxc_cgroup_mount_point_free);
-	if (meta_data->hierarchies) {
+	if (meta_data->hierarchies)
 		for (i = 0; i <= meta_data->maximum_hierarchy; i++)
-			lxc_cgroup_hierarchy_free(meta_data->hierarchies[i]);
-	}
+			if (meta_data->hierarchies[i])
+				lxc_cgroup_hierarchy_free(meta_data->hierarchies[i]);
 	free(meta_data->hierarchies);
 	free(meta_data);
 	return NULL;
@@ -1798,9 +1798,16 @@ static void lxc_cgroup_hierarchy_free(struct cgroup_hierarchy *h)
 {
 	if (!h)
 		return;
-	lxc_free_array((void **)h->subsystems, free);
-	free(h->all_mount_points);
+	if (h->subsystems) {
+		lxc_free_array((void **)h->subsystems, free);
+		h->subsystems = NULL;
+	}
+	if (h->all_mount_points) {
+		free(h->all_mount_points);
+		h->all_mount_points = NULL;
+	}
 	free(h);
+	h = NULL;
 }
 
 static bool is_valid_cgroup(const char *name)