In uadk_e_ctx_init(), the error path frees priv->data without NULLing it, so a second re-init failure frees it again. The same issue exists in async_module_init() where poll_queue.head is freed on error but not NULLed. Fix both by setting the pointer to NULL immediately after free. Signed-off-by: Weili Qian <qianweili@huawei.com> --- src/uadk_aead.c | 4 ++-- src/uadk_async.c | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/src/uadk_aead.c b/src/uadk_aead.c index db5faf7..20e0631 100644 --- a/src/uadk_aead.c +++ b/src/uadk_aead.c @@ -320,8 +320,8 @@ static int uadk_e_ctx_init(struct aead_priv_ctx *priv, const unsigned char *ckey return UADK_E_SUCCESS; free_data: - if (priv->data) - free(priv->data); + free(priv->data); + priv->data = NULL; out: wd_aead_free_sess(priv->sess); priv->sess = 0; diff --git a/src/uadk_async.c b/src/uadk_async.c index 76aa6a1..d38a61a 100644 --- a/src/uadk_async.c +++ b/src/uadk_async.c @@ -390,6 +390,7 @@ destroy_empty_sem: sem_destroy(&poll_queue.empty_sem); free_head: OPENSSL_free(poll_queue.head); + poll_queue.head = NULL; destroy_mutex: pthread_mutex_destroy(&poll_queue.async_task_mutex); @@ -399,7 +400,6 @@ destroy_mutex: void async_module_uninit(void) { int error; - struct async_poll_task *task; /* Disable async poll state first */ uadk_e_set_async_poll_state(DISABLE_ASYNC_POLLING); @@ -413,9 +413,8 @@ void async_module_uninit(void) if (poll_queue.thread_id) pthread_join(poll_queue.thread_id, NULL); - task = poll_queue.head; - if (task) - OPENSSL_free(task); + if (poll_queue.head) + OPENSSL_free(poll_queue.head); poll_queue.head = NULL; -- 2.43.0