From: Marc-André Lureau <marcandre.lureau@redhat.com>

The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
cause invalid system calls, as the QIOChannel is assumed to be properly
initialized later on.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 chardev/char-fd.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 1cd62f2779..ee85a52c06 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -133,15 +133,19 @@ void qemu_chr_open_fd(Chardev *chr,
     FDChardev *s = FD_CHARDEV(chr);
     char *name;
 
-    s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
-    name = g_strdup_printf("chardev-file-in-%s", chr->label);
-    qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
-    g_free(name);
-    s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
-    name = g_strdup_printf("chardev-file-out-%s", chr->label);
-    qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
-    g_free(name);
-    qemu_set_nonblock(fd_out);
+    if (fd_in >= 0) {
+        s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
+        name = g_strdup_printf("chardev-file-in-%s", chr->label);
+        qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
+        g_free(name);
+    }
+    if (fd_out >= 0) {
+        s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
+        name = g_strdup_printf("chardev-file-out-%s", chr->label);
+        qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
+        g_free(name);
+        qemu_set_nonblock(fd_out);
+    }
 }
 
 static void char_fd_class_init(ObjectClass *oc, void *data)
-- 
2.32.0.264.g75ae10bc75

On Fri, Jul 23, 2021 at 02:28:22PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
> cause invalid system calls, as the QIOChannel is assumed to be properly
> initialized later on.
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  chardev/char-fd.c | 22 +++++++++++++---------
>  1 file changed, 13 insertions(+), 9 deletions(-)
> 
> diff --git a/chardev/char-fd.c b/chardev/char-fd.c
> index 1cd62f2779..ee85a52c06 100644
> --- a/chardev/char-fd.c
> +++ b/chardev/char-fd.c
> @@ -133,15 +133,19 @@ void qemu_chr_open_fd(Chardev *chr,
>      FDChardev *s = FD_CHARDEV(chr);
>      char *name;
>  
> -    s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> -    name = g_strdup_printf("chardev-file-in-%s", chr->label);
> -    qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> -    g_free(name);
> -    s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> -    name = g_strdup_printf("chardev-file-out-%s", chr->label);
> -    qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> -    g_free(name);
> -    qemu_set_nonblock(fd_out);
> +    if (fd_in >= 0) {
> +        s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> +        name = g_strdup_printf("chardev-file-in-%s", chr->label);
> +        qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> +        g_free(name);
> +    }
> +    if (fd_out >= 0) {
> +        s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> +        name = g_strdup_printf("chardev-file-out-%s", chr->label);
> +        qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> +        g_free(name);
> +        qemu_set_nonblock(fd_out);
> +    }

Other code in this file assumes ioc_out is non-NULL, so this looks
like an incomplete fix.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Hi

On Tue, Aug 3, 2021 at 12:41 PM Daniel P. Berrangé <berrange@redhat.com>
wrote:

> On Fri, Jul 23, 2021 at 02:28:22PM +0400, marcandre.lureau@redhat.com
> wrote:
> > From: Marc-André Lureau <marcandre.lureau@redhat.com>
> >
> > The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
> > cause invalid system calls, as the QIOChannel is assumed to be properly
> > initialized later on.
> >
> > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > ---
> >  chardev/char-fd.c | 22 +++++++++++++---------
> >  1 file changed, 13 insertions(+), 9 deletions(-)
> >
> > diff --git a/chardev/char-fd.c b/chardev/char-fd.c
> > index 1cd62f2779..ee85a52c06 100644
> > --- a/chardev/char-fd.c
> > +++ b/chardev/char-fd.c
> > @@ -133,15 +133,19 @@ void qemu_chr_open_fd(Chardev *chr,
> >      FDChardev *s = FD_CHARDEV(chr);
> >      char *name;
> >
> > -    s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> > -    name = g_strdup_printf("chardev-file-in-%s", chr->label);
> > -    qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> > -    g_free(name);
> > -    s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> > -    name = g_strdup_printf("chardev-file-out-%s", chr->label);
> > -    qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> > -    g_free(name);
> > -    qemu_set_nonblock(fd_out);
> > +    if (fd_in >= 0) {
> > +        s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> > +        name = g_strdup_printf("chardev-file-in-%s", chr->label);
> > +        qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> > +        g_free(name);
> > +    }
> > +    if (fd_out >= 0) {
> > +        s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> > +        name = g_strdup_printf("chardev-file-out-%s", chr->label);
> > +        qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> > +        g_free(name);
> > +        qemu_set_nonblock(fd_out);
> > +    }
>
> Other code in this file assumes ioc_out is non-NULL, so this looks
> like an incomplete fix.
>
>
Right, I am adding a patch to correct the source watch creation, and fixing
this one handling !ioc_out condition.

thanks

-- 
Marc-André Lureau