31 lines
1.2 KiB
Diff
31 lines
1.2 KiB
Diff
From: Martin Osvald <mosvald@redhat.com>
|
|
Date: Wed, 6 Aug 2026 10:00:00 +0200
|
|
Subject: [PATCH] Fix sll pointer leak for aliased InfiniBand interfaces
|
|
|
|
When get_ll() fails for an aliased IB interface (e.g. ib0:0) and
|
|
ioctl_get_ll() is used instead (sll_allocated=1), the ARPHRD_INFINIBAND
|
|
case strips the alias suffix and re-calls get_ll(), overwriting sll with
|
|
an ifaddrs-internal pointer while sll_allocated remains 1. The subsequent
|
|
dfree(sll, MDL) then frees a pointer not returned by dmalloc, causing
|
|
heap corruption and SIGABRT ("free(): invalid pointer").
|
|
|
|
Free the ioctl_get_ll() allocation before overwriting sll.
|
|
|
|
Signed-off-by: Martin Osvald <mosvald@redhat.com>
|
|
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
|
diff --git a/common/lpf.c b/common/lpf.c
|
|
index 25f4c68..cbbdedc 100644
|
|
--- a/common/lpf.c
|
|
+++ b/common/lpf.c
|
|
@@ -784,6 +784,10 @@ get_hw_addr2(struct interface_info *info)
|
|
*/
|
|
if ((colon = strchr(dup, ':')) != NULL) {
|
|
*colon = '\0';
|
|
+ if (sll_allocated) {
|
|
+ dfree(sll, MDL);
|
|
+ sll_allocated = 0;
|
|
+ }
|
|
if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL)
|
|
log_fatal("Error getting hardware address for \"%s\": %m", name);
|
|
}
|