From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 20 Feb 2019 02:32:29 +0000 (+0900)
Subject: network: fix invalid memory access
X-Git-Tag: v242-rc1~248^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=033295c188bfba28b693fb9da789678503c335c7;p=thirdparty%2Fsystemd.git

network: fix invalid memory access

This fixes a bug introduced by 959f65d32ec15cf84afe3efff1a18b0987b56c60.
---

diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index e6a1cfd5d21..f894bb5c582 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -592,8 +592,8 @@ static void link_detach_from_manager(Link *link) {
 }
 
 static Link *link_free(Link *link) {
+        Link *carrier, *master;
         Address *address;
-        Link *carrier;
         Route *route;
         Iterator i;
 
@@ -661,6 +661,12 @@ static Link *link_free(Link *link) {
 
         hashmap_free(link->bond_slaves);
 
+        if (link->network) {
+                if (link->network->bond &&
+                    link_get(link->manager, link->network->bond->ifindex, &master) >= 0)
+                        (void) hashmap_remove(master->bond_slaves, INT_TO_PTR(link->ifindex));
+        }
+
         return mfree(link);
 }
 
diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index 8eb6e86c337..00f6545e24f 100644
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -1427,9 +1427,6 @@ void manager_free(Manager *m) {
         sd_netlink_unref(m->genl);
         sd_resolve_unref(m->resolve);
 
-        while ((network = m->networks))
-                network_free(network);
-
         while ((link = hashmap_first(m->dhcp6_prefixes)))
                 manager_dhcp6_prefix_remove_all(m, link);
         hashmap_free(m->dhcp6_prefixes);
@@ -1445,6 +1442,9 @@ void manager_free(Manager *m) {
         m->links_requesting_uuid = set_free(m->links_requesting_uuid);
         set_free(m->duids_requesting_uuid);
 
+        while ((network = m->networks))
+                network_free(network);
+
         hashmap_free(m->networks_by_name);
 
         m->netdevs = hashmap_free_with_destructor(m->netdevs, netdev_unref);