From 4ff7aeff393da1c2bfdef35c0990a06719d30b52 Mon Sep 17 00:00:00 2001 From: Sebastian Ott Date: Fri, 16 Mar 2018 16:21:47 +0100 Subject: [PATCH] lscss: fix double free in print_defunct_devices MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit double free or corruption (out) Program received signal SIGABRT, Aborted. 0x000003fffdd40404 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x000003fffdd40404 in raise () from /lib64/libc.so.6 #1 0x000003fffdd41ec2 in abort () from /lib64/libc.so.6 #2 0x000003fffdd88d8e in __libc_message () from /lib64/libc.so.6 #3 0x000003fffdd905c8 in malloc_printerr () from /lib64/libc.so.6 #4 0x000003fffdd98dfa in free () from /lib64/libc.so.6 #5 0x0000000001005994 in util_ptr_vec_free (count=, ptr_vec=0x101de90) at ../include/lib/util_base.h:46 #6 util_scandir_free (de_vec=0x101de90, count=) at util_scandir.c:174 #7 0x00000000010043ce in print_defunct_devices (rec=rec@entry=0x10114f0, path=path@entry=0x101cc80 "/sys/devices/css0/defunct") at lscss.c:678 #8 0x0000000001004cfe in print_subchannels_of_type (type_requested=type_requested@entry=SUBCHANNEL_TYPE_IO, rec=rec@entry=0x10114f0) at lscss.c:726 #9 0x0000000001003888 in cmd_lscss () at lscss.c:761 #10 main (argc=, argv=) at lscss.c:932 Signed-off-by: Sebastian Ott Signed-off-by: Jan Höppner --- zconf/css/lscss.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/zconf/css/lscss.c b/zconf/css/lscss.c index 951e03a6..7aba2b9d 100644 --- a/zconf/css/lscss.c +++ b/zconf/css/lscss.c @@ -649,14 +649,12 @@ static void print_defunct_devices(struct util_rec *rec, char *path) snprintf(buf, sizeof(buf), "%s", device); } if (cmd.opt_devrange && cmd.rng_count > 0 && - !id_in_ranges_list(device)) { - util_scandir_free(de_vec, count); + !id_in_ranges_list(device)) continue; - } - if (fill_device_info(rec, path, device) != 0) { - util_scandir_free(de_vec, count); + + if (fill_device_info(rec, path, device) != 0) continue; - } + if (cmd.opt_uppercase) util_str_toupper(buf); util_rec_set(rec, "device", "%s", buf);