cleanup_session was getting called twice ( once from removal of entry from global hash table ( i.e session_hash and another direct call from error case in session_policy_config_cb.) which was resulting in memory corruption due to use after free. This patch removes calling cleanup_session twice in session_policy_config_cb. --- src/session.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/session.c b/src/session.c index 834b3a6..5a14cef 100644 --- a/src/session.c +++ b/src/session.c @@ -1407,8 +1407,9 @@ static int session_policy_config_cb(struct connman_session *session, session_methods, NULL, NULL, session, NULL)) { connman_error("Failed to register %s", session->session_path); + g_hash_table_remove(session_hash, session->session_path); err = -EINVAL; - goto err; + goto err_notify; } reply = g_dbus_create_reply(creation_data->pending, @@ -1433,12 +1434,13 @@ static int session_policy_config_cb(struct connman_session *session, return 0; err: - g_hash_table_remove(session_hash, session->session_path); + cleanup_session(session); + +err_notify: reply = __connman_error_failed(creation_data->pending, -err); g_dbus_send_message(connection, reply); creation_data->pending = NULL; - cleanup_session(session); cleanup_creation_data(creation_data); return err; -- 1.9.1