Commit 0bd1ca9d authored by Jim Harris's avatar Jim Harris Committed by Konrad Sztyber
Browse files

bdev/nvme: fix use-after-free in mdns_resolve_callback() 



If we find that the discovery entry already exists, a
single break doesn't work - that just breaks out of
the TAILQ_FOREACH.  So instead change it to free
the resolver object and return directly.

Fixes issue #2945.

Signed-off-by: default avatarJim Harris <james.r.harris@intel.com>
Change-Id: Ia31d6ecfa4fdc0a168eecc8ec4659da10a870770
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/17209


Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarAleksey Marchuk <alexeymar@nvidia.com>
Reviewed-by: default avatarKarol Latecki <karol.latecki@intel.com>
parent 7c3c0b66

module/bdev/nvme/bdev_mdns_client.c

+2 −1
Original line number Diff line number Diff line
@@ -325,7 +325,8 @@ mdns_resolve_callback( 
				free(trid);

				avahi_free(subnqn);

				avahi_free(proto);

				break;

				avahi_service_resolver_free(r);

				return;

			}

		}

		entry_ctx = create_mdns_discovery_entry_ctx(ctx, trid);