net/colo: fix g_hash_table_destroy assertion on uninitialized filter

[PATCH] net/colo: fix g_hash_table_destroy assertion on uninitialized filter

marcandre.lureau@redhat.com posted 1 patch 2 weeks, 2 days ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260709111315.1108185-1-marcandre.lureau@redhat.com

Maintainers: Zhang Chen <zhangckid@gmail.com>, Li Zhijian <lizhijian@fujitsu.com>, Jason Wang <jasowangio@gmail.com>

net/filter-rewriter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] net/colo: fix g_hash_table_destroy assertion on uninitialized filter

Posted by marcandre.lureau@redhat.com 2 weeks, 2 days ago

From: Marc-André Lureau <marcandre.lureau@redhat.com>

colo_rewriter_cleanup() unconditionally destroys connection_track_table,
but the table is only allocated in colo_rewriter_setup(). When the
filter-rewriter object is finalized without having been set up (e.g.
during qom-test property enumeration), the pointer is NULL and
g_hash_table_destroy() fires an assertion.

Use g_clear_pointer() to skip the destroy when the table was never
initialized.

Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
---
 net/filter-rewriter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
index cdf85aa5eed..c85d180eb96 100644
--- a/net/filter-rewriter.c
+++ b/net/filter-rewriter.c
@@ -373,7 +373,7 @@ static void colo_rewriter_cleanup(NetFilterState *nf)
         g_free(s->incoming_queue);
     }
 
-    g_hash_table_destroy(s->connection_track_table);
+    g_clear_pointer(&s->connection_track_table, g_hash_table_destroy);
 }
 
 static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
-- 
2.55.0

Re: [PATCH] net/colo: fix g_hash_table_destroy assertion on uninitialized filter

Posted by Zhang Chen 2 weeks, 2 days ago

On Thu, Jul 9, 2026 at 7:13 PM <marcandre.lureau@redhat.com> wrote:
>
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> colo_rewriter_cleanup() unconditionally destroys connection_track_table,
> but the table is only allocated in colo_rewriter_setup(). When the
> filter-rewriter object is finalized without having been set up (e.g.
> during qom-test property enumeration), the pointer is NULL and
> g_hash_table_destroy() fires an assertion.
>
> Use g_clear_pointer() to skip the destroy when the table was never
> initialized.
>
> Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>

Looks good to me.
Are you working for filter-rewriter's qom-test?
There is no place in the current implementation where this issue would
be triggered.

Reviewed-by: Zhang Chen <zhangckid@gmail.com>

> ---
>  net/filter-rewriter.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
> index cdf85aa5eed..c85d180eb96 100644
> --- a/net/filter-rewriter.c
> +++ b/net/filter-rewriter.c
> @@ -373,7 +373,7 @@ static void colo_rewriter_cleanup(NetFilterState *nf)
>          g_free(s->incoming_queue);
>      }
>
> -    g_hash_table_destroy(s->connection_track_table);
> +    g_clear_pointer(&s->connection_track_table, g_hash_table_destroy);
>  }
>
>  static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
> --
> 2.55.0
>