[v2] spice-char: fix segfault in char_spice_finalize

[Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize

Posted by Li Qiang 8 years, 11 months ago

In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
call 'char_spice_finalize'. But as the SpiceChardev is not inserted
in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
Add a detect to avoid it.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
 spice-qemu-char.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 6f46f46..4d1c76e 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
     SpiceChardev *s = SPICE_CHARDEV(obj);
 
     vmc_unregister_interface(s);
-    QLIST_REMOVE(s, next);
+
+    if (s->next.le_prev) {
+        QLIST_REMOVE(s, next);
+    }
 
     g_free((char *)s->sin.subtype);
 #if SPICE_SERVER_VERSION >= 0x000c02
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize

Posted by Marc-André Lureau 8 years, 11 months ago

Hi

----- Original Message -----
> In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> Add a detect to avoid it.
> 
> Signed-off-by: Li Qiang <liqiang6-s@360.cn>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
>  spice-qemu-char.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> index 6f46f46..4d1c76e 100644
> --- a/spice-qemu-char.c
> +++ b/spice-qemu-char.c
> @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
>      SpiceChardev *s = SPICE_CHARDEV(obj);
>  
>      vmc_unregister_interface(s);
> -    QLIST_REMOVE(s, next);
> +
> +    if (s->next.le_prev) {
> +        QLIST_REMOVE(s, next);
> +    }
>  
>      g_free((char *)s->sin.subtype);
>  #if SPICE_SERVER_VERSION >= 0x000c02
> --
> 1.8.3.1
> 
>

Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize

Posted by Li Qiang 8 years, 11 months ago

Hello Paolo,

Have you queued this patch?

2017-02-21 16:32 GMT+08:00 Marc-André Lureau <mlureau@redhat.com>:

> Hi
>
> ----- Original Message -----
> > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> > call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> > Add a detect to avoid it.
> >
> > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> > ---
> >  spice-qemu-char.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> > index 6f46f46..4d1c76e 100644
> > --- a/spice-qemu-char.c
> > +++ b/spice-qemu-char.c
> > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
> >      SpiceChardev *s = SPICE_CHARDEV(obj);
> >
> >      vmc_unregister_interface(s);
> > -    QLIST_REMOVE(s, next);
> > +
> > +    if (s->next.le_prev) {
> > +        QLIST_REMOVE(s, next);
> > +    }
> >
> >      g_free((char *)s->sin.subtype);
> >  #if SPICE_SERVER_VERSION >= 0x000c02
> > --
> > 1.8.3.1
> >
> >
>

Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize

Posted by Paolo Bonzini 8 years, 11 months ago


On 02/03/2017 11:20, Li Qiang wrote:
> Hello Paolo,
> 
> Have you queued this patch?

No, I thought Gerd would.  Queued now.

Paolo

> 2017-02-21 16:32 GMT+08:00 Marc-André Lureau <mlureau@redhat.com
> <mailto:mlureau@redhat.com>>:
> 
>     Hi
> 
>     ----- Original Message -----
>     > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
>     > call 'char_spice_finalize'. But as the SpiceChardev is not inserted
>     > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
>     > Add a detect to avoid it.
>     >
>     > Signed-off-by: Li Qiang <liqiang6-s@360.cn <mailto:liqiang6-s@360.cn>>
> 
>     Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com
>     <mailto:marcandre.lureau@redhat.com>>
> 
>     > ---
>     >  spice-qemu-char.c | 5 ++++-
>     >  1 file changed, 4 insertions(+), 1 deletion(-)
>     >
>     > diff --git a/spice-qemu-char.c b/spice-qemu-char.c
>     > index 6f46f46..4d1c76e 100644
>     > --- a/spice-qemu-char.c
>     > +++ b/spice-qemu-char.c
>     > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
>     >      SpiceChardev *s = SPICE_CHARDEV(obj);
>     >
>     >      vmc_unregister_interface(s);
>     > -    QLIST_REMOVE(s, next);
>     > +
>     > +    if (s->next.le_prev) {
>     > +        QLIST_REMOVE(s, next);
>     > +    }
>     >
>     >      g_free((char *)s->sin.subtype);
>     >  #if SPICE_SERVER_VERSION >= 0x000c02
>     > --
>     > 1.8.3.1
>     >
>     >
> 
>