1. Patchew
  2. QEMU
  3. View series

[Qemu-devel] [PATCH] readline: don't free completions in readline_free()

Greg Kurz posted 1 patch 7 years, 9 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/151627206353.4505.4602428849861610759.stgit@bahia.lan
Test checkpatch passed
Test docker-build@min-glib passed
Test docker-mingw@fedora passed
Test docker-quick@centos6 passed
Test ppc passed
Test s390x passed
util/readline.c |    3 ---
1 file changed, 3 deletions(-)
[Qemu-devel] [PATCH] readline: don't free completions in readline_free()
Posted by Greg Kurz 7 years, 9 months ago 
Since commit e5dc1a6c6c43, QEMU aborts on exit if completion was used
in the monitor:

*** Error in `obj/ppc64-softmmu/qemu-system-ppc64': double free or
 corruption (fasttop): 0x00000100331069d0 ***

#0  0x00007ffff267eff0 in raise () from /lib64/libc.so.6
#1  0x00007ffff268136c in abort () from /lib64/libc.so.6
#2  0x00007ffff26c6b48 in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff26d69fc in free () from /lib64/libc.so.6
#4  0x00007ffff28cb794 in g_free () from /lib64/libglib-2.0.so.0
#5  0x00000000106230e4 in readline_free (rs=0x11223e60) at
 /home/greg/Work/qemu/qemu-spapr/util/readline.c:514
#6  0x0000000010074cc4 in monitor_data_destroy (mon=0x1121c9f0) at
 /home/greg/Work/qemu/qemu-spapr/monitor.c:586
#7  0x000000001007bcc8 in monitor_cleanup () at
 /home/greg/Work/qemu/qemu-spapr/monitor.c:4125
#8  0x0000000010291274 in main (argc=<optimized out>,
 argv=<optimized out>, envp=<optimized out>) at
 /home/greg/Work/qemu/qemu-spapr/vl.c:4795

Completion strings are not persistent accross completions (why would
they?). They are allocated under readline_completion(), which already
takes care of freeing them before returning.

Maybe all completion related bits should be moved out of ReadLineState
to a dedicated structure ?

In the meantime, let's drop the offending lines from readline_free()
to fix the crash.

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 util/readline.c |    3 ---
 1 file changed, 3 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index 24ec839854cf..ec91ee0fea6f 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -510,9 +510,6 @@ void readline_free(ReadLineState *rs)
     for (i = 0; i < READLINE_MAX_CMDS; i++) {
         g_free(rs->history[i]);
     }
-    for (i = 0; i < READLINE_MAX_COMPLETIONS; i++) {
-        g_free(rs->completions[i]);
-    }
     g_free(rs);
 }
Re: [Qemu-devel] [PATCH] readline: don't free completions in readline_free()
Posted by Paolo Bonzini 7 years, 9 months ago 
On 18/01/2018 11:41, Greg Kurz wrote:
> Since commit e5dc1a6c6c43, QEMU aborts on exit if completion was used
> in the monitor:
> 
> *** Error in `obj/ppc64-softmmu/qemu-system-ppc64': double free or
>  corruption (fasttop): 0x00000100331069d0 ***
> 
> #0  0x00007ffff267eff0 in raise () from /lib64/libc.so.6
> #1  0x00007ffff268136c in abort () from /lib64/libc.so.6
> #2  0x00007ffff26c6b48 in __libc_message () from /lib64/libc.so.6
> #3  0x00007ffff26d69fc in free () from /lib64/libc.so.6
> #4  0x00007ffff28cb794 in g_free () from /lib64/libglib-2.0.so.0
> #5  0x00000000106230e4 in readline_free (rs=0x11223e60) at
>  /home/greg/Work/qemu/qemu-spapr/util/readline.c:514
> #6  0x0000000010074cc4 in monitor_data_destroy (mon=0x1121c9f0) at
>  /home/greg/Work/qemu/qemu-spapr/monitor.c:586
> #7  0x000000001007bcc8 in monitor_cleanup () at
>  /home/greg/Work/qemu/qemu-spapr/monitor.c:4125
> #8  0x0000000010291274 in main (argc=<optimized out>,
>  argv=<optimized out>, envp=<optimized out>) at
>  /home/greg/Work/qemu/qemu-spapr/vl.c:4795
> 
> Completion strings are not persistent accross completions (why would
> they?). They are allocated under readline_completion(), which already
> takes care of freeing them before returning.
> 
> Maybe all completion related bits should be moved out of ReadLineState
> to a dedicated structure ?
> 
> In the meantime, let's drop the offending lines from readline_free()
> to fix the crash.
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
>  util/readline.c |    3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/util/readline.c b/util/readline.c
> index 24ec839854cf..ec91ee0fea6f 100644
> --- a/util/readline.c
> +++ b/util/readline.c
> @@ -510,9 +510,6 @@ void readline_free(ReadLineState *rs)
>      for (i = 0; i < READLINE_MAX_CMDS; i++) {
>          g_free(rs->history[i]);
>      }
> -    for (i = 0; i < READLINE_MAX_COMPLETIONS; i++) {
> -        g_free(rs->completions[i]);
> -    }
>      g_free(rs);
>  }
>  
> 

Queued, thanks.

Paolo
Re: [Qemu-devel] [PATCH] readline: don't free completions in readline_free()
Posted by Philippe Mathieu-Daudé 7 years, 9 months ago 
On 01/18/2018 07:45 AM, Paolo Bonzini wrote:
> On 18/01/2018 11:41, Greg Kurz wrote:
>> Since commit e5dc1a6c6c43, QEMU aborts on exit if completion was used
>> in the monitor:
>>
>> *** Error in `obj/ppc64-softmmu/qemu-system-ppc64': double free or
>>  corruption (fasttop): 0x00000100331069d0 ***
>>
>> #0  0x00007ffff267eff0 in raise () from /lib64/libc.so.6
>> #1  0x00007ffff268136c in abort () from /lib64/libc.so.6
>> #2  0x00007ffff26c6b48 in __libc_message () from /lib64/libc.so.6
>> #3  0x00007ffff26d69fc in free () from /lib64/libc.so.6
>> #4  0x00007ffff28cb794 in g_free () from /lib64/libglib-2.0.so.0
>> #5  0x00000000106230e4 in readline_free (rs=0x11223e60) at
>>  /home/greg/Work/qemu/qemu-spapr/util/readline.c:514
>> #6  0x0000000010074cc4 in monitor_data_destroy (mon=0x1121c9f0) at
>>  /home/greg/Work/qemu/qemu-spapr/monitor.c:586
>> #7  0x000000001007bcc8 in monitor_cleanup () at
>>  /home/greg/Work/qemu/qemu-spapr/monitor.c:4125
>> #8  0x0000000010291274 in main (argc=<optimized out>,
>>  argv=<optimized out>, envp=<optimized out>) at
>>  /home/greg/Work/qemu/qemu-spapr/vl.c:4795
>>
>> Completion strings are not persistent accross completions (why would
>> they?). They are allocated under readline_completion(), which already
>> takes care of freeing them before returning.

Oops I missed that.

>>
>> Maybe all completion related bits should be moved out of ReadLineState
>> to a dedicated structure ?
>>
>> In the meantime, let's drop the offending lines from readline_free()
>> to fix the crash.
>>
>> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

>> ---
>>  util/readline.c |    3 ---
>>  1 file changed, 3 deletions(-)
>>
>> diff --git a/util/readline.c b/util/readline.c
>> index 24ec839854cf..ec91ee0fea6f 100644
>> --- a/util/readline.c
>> +++ b/util/readline.c
>> @@ -510,9 +510,6 @@ void readline_free(ReadLineState *rs)
>>      for (i = 0; i < READLINE_MAX_CMDS; i++) {
>>          g_free(rs->history[i]);
>>      }
>> -    for (i = 0; i < READLINE_MAX_COMPLETIONS; i++) {
>> -        g_free(rs->completions[i]);
>> -    }
>>      g_free(rs);
>>  }
>>  
>>
> 
> Queued, thanks.
> 
> Paolo
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.