From nobody Tue Apr 7 21:45:14 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241975; cv=none; d=zohomail.com; s=zohoarc; b=FvmTiCIpjqbCxk7fGj54nAftu/4U5cRc5X/e45GIOEAAA9zowuLxPInbvTsrM9lo4afuy27AHfdUNAhbcMLtDbhLEvqL0dxFLpqgQUS+/XiGwLiPkysfTJGwEfuc3LhQ0MEbmz1YYOYl1Bpq6av0BfruprdG/YjRmOqHU1GZQp0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241975; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oB2lmmp+7pvnbhGIdIvCeO4tHPjIuZPna6chfqxOYXo=; b=gPhpCs2p6ol1+Pwl2qpjKb9Qz6I8kDemOyj/yzgslP29JsuEYPjziI5P/LP/RpG+lPDDJon2sqDxXXWLLg1y5pjNuD92zMaYJlj2zeWMt7Z1Skf27wBGFY8DXWXemoVp8Fbh3Kku8SGF5N+hYRNSeT+pvnRl1EdOK8OANgjKSG4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241975489221.84327588780502; Wed, 11 Mar 2026 08:12:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LD7-0003Xy-64; Wed, 11 Mar 2026 11:11:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBl-0001JM-PU; Wed, 11 Mar 2026 11:09:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBj-0005lW-NL; Wed, 11 Mar 2026 11:09:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 165C7191EA0; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0491037C2E1; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=CYzXWLGQoPXvgockatRsrujnVIM9hpdoLe9ML5C28m0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qd25xpnejlajLhxFTaR5+KcQr07MekyJxH/+6OHuZzlxuB9g87VvRMmF5mPLL3mSR PgIBw1ZpB+MsgMklJROS3/bCYT8PB7kS9qVF8dgMN0HDTJP4Kn/n4YcO9J1BQwvARq g6rhExcrq5obGigfHnip+bEAXlOABfJjYR+1W5RNRIdIR4cYAbITsZYXQDSXoqX7zO hgQYGQFMYhzelP9AyBJ+EcP5buuCfc5tDyv3RPIfhxNn4fHO9G2WBzscKbocJw7hlJ aPZ5TLLhN5BEe8w7EAa1JXhk9AVhTmEE1G+Y3Evj4qkcP3nwI5SwzoeYhkCV7Otg3j f+nONhxpc58vQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.1.5 29/46] io: fix cleanup for TLS I/O source data on cancellation Date: Wed, 11 Mar 2026 18:03:05 +0300 Message-ID: <20260311150327.1084669-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241977137158500 From: Daniel P. Berrang=C3=A9 The TLS code will create a GSource for tracking completion of the handshake process, passing a QIOChannelTLSData struct that contains various data items. The data struct is freed by the callback when it completes, which means when a source is cancelled, nothing is free'ing the data struct or its contents. Switch to provide a data free callback to the GSource, which ensures the QIOChannelTLSData struct is always freed even when the main event callback never fires. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3114 Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit d39d0f3acdd7c1bb275db7e97b511f98254ecd9f) Signed-off-by: Michael Tokarev diff --git a/io/channel-tls.c b/io/channel-tls.c index ce4ee6bb98..a686ee2058 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -153,13 +153,32 @@ struct QIOChannelTLSData { }; typedef struct QIOChannelTLSData QIOChannelTLSData; =20 +static void qio_channel_tls_io_data_free(gpointer user_data) +{ + QIOChannelTLSData *data =3D user_data; + /* + * Usually 'task' will be NULL since the GSource + * callback will either complete the task or pass + * it on to a new GSource. We'll see a non-NULL + * task here only if the GSource was released before + * its callback triggers + */ + if (data->task) { + qio_task_free(data->task); + } + if (data->context) { + g_main_context_unref(data->context); + } + g_free(data); +} + static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, GIOCondition condition, gpointer user_data); =20 -static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, - QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_handshake_task(QIOChannelTLS *ioc, + QIOTask *task, + GMainContext *context) { Error *err =3D NULL; int status; @@ -170,8 +189,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_handshake_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_HANDSHAKE_COMPLETE) { @@ -184,7 +202,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_credentials_allow(ioc); } qio_task_complete(task); - qio_task_free(task); + return TRUE; } else { GIOCondition condition; QIOChannelTLSData *data =3D g_new0(typeof(*data), 1); @@ -208,8 +226,9 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, condition, qio_channel_tls_handshake_io, data, - NULL, + qio_channel_tls_io_data_free, context); + return FALSE; } } =20 @@ -225,11 +244,9 @@ static gboolean qio_channel_tls_handshake_io(QIOChanne= l *ioc, qio_task_get_source(task)); =20 tioc->hs_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_handshake_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_handshake_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; @@ -252,14 +269,16 @@ void qio_channel_tls_handshake(QIOChannelTLS *ioc, func, opaque, destroy); =20 trace_qio_channel_tls_handshake_start(ioc); - qio_channel_tls_handshake_task(ioc, task, context); + if (qio_channel_tls_handshake_task(ioc, task, context)) { + qio_task_free(task); + } } =20 static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condi= tion, gpointer user_data); =20 -static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, + GMainContext *context) { GIOCondition condition; QIOChannelTLSData *data; @@ -272,14 +291,12 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *i= oc, QIOTask *task, trace_qio_channel_tls_bye_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_BYE_COMPLETE) { qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 data =3D g_new0(typeof(*data), 1); @@ -299,7 +316,10 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *io= c, QIOTask *task, trace_qio_channel_tls_bye_pending(ioc, status); ioc->bye_ioc_tag =3D qio_channel_add_watch_full(ioc->master, condition, qio_channel_tls_bye_io, - data, NULL, context); + data, + qio_channel_tls_io_data_= free, + context); + return FALSE; } =20 =20 @@ -312,11 +332,9 @@ static gboolean qio_channel_tls_bye_io(QIOChannel *ioc= , GIOCondition condition, QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(qio_task_get_source(task)); =20 tioc->bye_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_bye_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_bye_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; --=20 2.47.3