Linux-Bluetooth Archive on
 help / color / Atom feed
* [PATCH BlueZ] mesh: Fix double-free
@ 2020-05-20 15:35 Brian Gix
  0 siblings, 0 replies; only message in thread
From: Brian Gix @ 2020-05-20 15:35 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: inga.stotland, brian.gix, michal.lowas-rzechonek

Fixing a prior memory leak created a double-free error when destroying
the NVM sorage of a node. We have two situations where we want to
discard a nodes dytnamic memory:

1. When the node is being deleted at runtime.  This causes release of
   both dynamic memory and NVM storage.

2. During shutdown, we release dynamic memory only.

This patch ensures that after node deletion releases dynamic memory,
the pointers to it are cleared, avoiding a second free attempt.
 mesh/node.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mesh/node.c b/mesh/node.c
index 2b4b3a563..03f4d342b 100644
--- a/mesh/node.c
+++ b/mesh/node.c
@@ -352,8 +352,10 @@ void node_remove(struct mesh_node *node)
 	l_queue_remove(nodes, node);
-	if (node->cfg)
+	if (node->cfg) {
+		node->cfg = NULL;
+	}

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-20 15:35 [PATCH BlueZ] mesh: Fix double-free Brian Gix

Linux-Bluetooth Archive on

Archives are clonable:
	git clone --mirror linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ \
	public-inbox-index linux-bluetooth

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone