From nobody Tue Apr 7 21:45:29 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241794; cv=none; d=zohomail.com; s=zohoarc; b=apQZu0sY7jLbNHAQ8qG2hi27qd8OcjZeAvKJd3ey2lAdAL6DuHkDIl7lCCbqyyAPLb02K4cDdhFoqIgMpY105Tdak7g50ekR3bzluE5TmBA7tk1ajXfrcRDxESqgGnrv8XO9lMKONDKuORcoUKpHXsdDmhvRvbwOd6mqftpvIzo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241794; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9tqo+ItfWPAjkbkUDYmhUcXFSCZhOyPoR4C92pCMQpU=; b=cnGoFlCz5oDA+ZZ5mMz5iLzm8lH+3KQl3OvHCOmv15F2+ExUbSi6q2fz6+QUJS16uOA5apVpQXwynfAQqY4Ri0TIuY69vzHh/789EQZuHtfct/uZueo92D1RC9d1d8gQkhh+cb0APlF0hj29p1ZDsYHTziqwFnm7ybRMcTHZP8k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241794630133.76628057072662; Wed, 11 Mar 2026 08:09:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0L8O-0002dI-Nq; Wed, 11 Mar 2026 11:06:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L74-0007zZ-Nj; Wed, 11 Mar 2026 11:04:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L72-0004FQ-GR; Wed, 11 Mar 2026 11:04:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5A45A191E59; Wed, 11 Mar 2026 18:01:45 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 46D1337C2AB; Wed, 11 Mar 2026 18:02:23 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241305; bh=4Nlfdi5GGWNBm6h4dFOA/ZCsnAbi/KsWlMfEchoZYTk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xbuCGkMj9QBoZyas6vUZX9njsd7X7F+vBqkVb9YnZxXwwGLwAoYIVI1dV/QBXlvgb DluSXy6IYPyFYc2/+5NEJNXyh5esiIFvW2DZk6YPTvCwKIqxPA0bTggMd5VjGwAZJO 1CH0mCWVT9ynqFIu9C96+m2Ts0MLkaY3SqlZfLZyEzfkkZx7YmfPQUh0FMC4xqjXoG Qr9/b1ShYvZGop2Yj0J43e3l3Kmn/DeIv9qXFu1TzzxJJaY2HDZTzDEkQGeOT2+SbG TND0c1Ks0N/dJtYCYE74DPTcc21tv823qgsMorBeUJsGOkbVzZZdTAdGXwoH/Dncer C0Sr0IApiDUiQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.0.9 27/44] io: fix cleanup for TLS I/O source data on cancellation Date: Wed, 11 Mar 2026 18:01:59 +0300 Message-ID: <20260311150221.1084186-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241796533154100 From: Daniel P. Berrang=C3=A9 The TLS code will create a GSource for tracking completion of the handshake process, passing a QIOChannelTLSData struct that contains various data items. The data struct is freed by the callback when it completes, which means when a source is cancelled, nothing is free'ing the data struct or its contents. Switch to provide a data free callback to the GSource, which ensures the QIOChannelTLSData struct is always freed even when the main event callback never fires. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3114 Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit d39d0f3acdd7c1bb275db7e97b511f98254ecd9f) Signed-off-by: Michael Tokarev diff --git a/io/channel-tls.c b/io/channel-tls.c index 919bbf10dd..329ef6759f 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -153,13 +153,32 @@ struct QIOChannelTLSData { }; typedef struct QIOChannelTLSData QIOChannelTLSData; =20 +static void qio_channel_tls_io_data_free(gpointer user_data) +{ + QIOChannelTLSData *data =3D user_data; + /* + * Usually 'task' will be NULL since the GSource + * callback will either complete the task or pass + * it on to a new GSource. We'll see a non-NULL + * task here only if the GSource was released before + * its callback triggers + */ + if (data->task) { + qio_task_free(data->task); + } + if (data->context) { + g_main_context_unref(data->context); + } + g_free(data); +} + static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, GIOCondition condition, gpointer user_data); =20 -static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, - QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_handshake_task(QIOChannelTLS *ioc, + QIOTask *task, + GMainContext *context) { Error *err =3D NULL; int status; @@ -170,8 +189,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_handshake_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_HANDSHAKE_COMPLETE) { @@ -184,7 +202,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_credentials_allow(ioc); } qio_task_complete(task); - qio_task_free(task); + return TRUE; } else { GIOCondition condition; QIOChannelTLSData *data =3D g_new0(typeof(*data), 1); @@ -208,8 +226,9 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, condition, qio_channel_tls_handshake_io, data, - NULL, + qio_channel_tls_io_data_free, context); + return FALSE; } } =20 @@ -225,11 +244,9 @@ static gboolean qio_channel_tls_handshake_io(QIOChanne= l *ioc, qio_task_get_source(task)); =20 tioc->hs_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_handshake_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_handshake_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; @@ -247,14 +264,16 @@ void qio_channel_tls_handshake(QIOChannelTLS *ioc, func, opaque, destroy); =20 trace_qio_channel_tls_handshake_start(ioc); - qio_channel_tls_handshake_task(ioc, task, context); + if (qio_channel_tls_handshake_task(ioc, task, context)) { + qio_task_free(task); + } } =20 static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condi= tion, gpointer user_data); =20 -static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, + GMainContext *context) { GIOCondition condition; QIOChannelTLSData *data; @@ -267,14 +286,12 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *i= oc, QIOTask *task, trace_qio_channel_tls_bye_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_BYE_COMPLETE) { qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 data =3D g_new0(typeof(*data), 1); @@ -294,7 +311,10 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *io= c, QIOTask *task, trace_qio_channel_tls_bye_pending(ioc, status); ioc->bye_ioc_tag =3D qio_channel_add_watch_full(ioc->master, condition, qio_channel_tls_bye_io, - data, NULL, context); + data, + qio_channel_tls_io_data_= free, + context); + return FALSE; } =20 =20 @@ -307,11 +327,9 @@ static gboolean qio_channel_tls_bye_io(QIOChannel *ioc= , GIOCondition condition, QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(qio_task_get_source(task)); =20 tioc->bye_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_bye_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_bye_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; --=20 2.47.3