[Qemu-devel] [PATCH 0/2] fix segfaults triggered by failed vnc handshakes

[Qemu-devel] [PATCH 0/2] fix segfaults triggered by failed vnc handshakes

[Tim Hardeck]

While trying to adapt Anthony Liguori's websockets patches to the current standard I ran into some segfaults.

They were triggered during disconnects due to failed VNC handshakes.

I have added checks to prevent them.

Tim Hardeck (2):
  vnc: fix segfault due to failed handshake
  qemu queue: fix uninitialized removals

 qemu-queue.h |    8 ++++++--
 ui/vnc.c     |    4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

-- 
1.7.10.4

[Qemu-devel] [PATCH 1/2] vnc: fix segfault due to failed handshake

[Tim Hardeck]

When the VNC server disconnects due to a failed handshake we don't have
vs->bh allocated yet.

Check for this case and don't delete it.

Signed-off-by: Tim Hardeck <thardeck@suse.de>
---
 ui/vnc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 01b2daf..656895a 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1055,7 +1055,9 @@ static void vnc_disconnect_finish(VncState *vs)
     vnc_unlock_output(vs);
 
     qemu_mutex_destroy(&vs->output_mutex);
-    qemu_bh_delete(vs->bh);
+    if (vs->bh != NULL) {
+        qemu_bh_delete(vs->bh);
+    }
     buffer_free(&vs->jobs_buffer);
 
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-- 
1.7.10.4

[Qemu-devel] [PATCH 2/2] qemu queue: fix uninitialized removals

[Tim Hardeck]

When calling QTAILQ_REMOVE or QLIST_REMOVE on an unitialized list
QEMU segfaults.

Check for this case specifically on item removal.

Signed-off-by: Tim Hardeck <thardeck@suse.de>
---
 qemu-queue.h |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/qemu-queue.h b/qemu-queue.h
index 9288cd8..47ed239 100644
--- a/qemu-queue.h
+++ b/qemu-queue.h
@@ -141,7 +141,9 @@ struct {                                                                \
         if ((elm)->field.le_next != NULL)                               \
                 (elm)->field.le_next->field.le_prev =                   \
                     (elm)->field.le_prev;                               \
-        *(elm)->field.le_prev = (elm)->field.le_next;                   \
+        if ((elm)->field.le_prev != NULL) {                             \
+            *(elm)->field.le_prev = (elm)->field.le_next;               \
+        }                                                               \
 } while (/*CONSTCOND*/0)
 
 #define QLIST_FOREACH(var, head, field)                                 \
@@ -381,7 +383,9 @@ struct {                                                                \
                     (elm)->field.tqe_prev;                              \
         else                                                            \
                 (head)->tqh_last = (elm)->field.tqe_prev;               \
-        *(elm)->field.tqe_prev = (elm)->field.tqe_next;                 \
+        if ((elm)->field.tqe_prev != NULL) {                            \
+            *(elm)->field.tqe_prev = (elm)->field.tqe_next;             \
+        }                                                               \
 } while (/*CONSTCOND*/0)
 
 #define QTAILQ_FOREACH(var, head, field)                                \
-- 
1.7.10.4

[Qemu-devel] [PATCH 1/2] vnc: fix segfault due to failed handshake

[Tim Hardeck]

When the VNC server disconnects due to a failed handshake we don't have
vs->bh allocated yet.

Check for this case and don't delete it.

Signed-off-by: Tim Hardeck <thardeck@suse.de>
---
 ui/vnc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 01b2daf..656895a 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1055,7 +1055,9 @@ static void vnc_disconnect_finish(VncState *vs)
     vnc_unlock_output(vs);
 
     qemu_mutex_destroy(&vs->output_mutex);
-    qemu_bh_delete(vs->bh);
+    if (vs->bh != NULL) {
+        qemu_bh_delete(vs->bh);
+    }
     buffer_free(&vs->jobs_buffer);
 
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-- 
1.7.10.4

Re: [Qemu-devel] [PATCH 1/2] vnc: fix segfault due to failed handshake

[Andreas Färber]

Am 14.10.2012 15:08, schrieb Tim Hardeck:
> When the VNC server disconnects due to a failed handshake we don't have
> vs->bh allocated yet.
> 
> Check for this case and don't delete it.
> 
> Signed-off-by: Tim Hardeck <thardeck@suse.de>
> ---
>  ui/vnc.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 01b2daf..656895a 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1055,7 +1055,9 @@ static void vnc_disconnect_finish(VncState *vs)
>      vnc_unlock_output(vs);
>  
>      qemu_mutex_destroy(&vs->output_mutex);
> -    qemu_bh_delete(vs->bh);
> +    if (vs->bh != NULL) {
> +        qemu_bh_delete(vs->bh);
> +    }
>      buffer_free(&vs->jobs_buffer);
>  
>      for (i = 0; i < VNC_STAT_ROWS; ++i) {

qemu_bh_delete() is not checking for a NULL argument, therefore this fix
looks good to me,

Acked-by: Andreas Färber <afaerber@suse.de>

Adding some CCs.

As a followup it might be a good idea to either assert or ignore a NULL
argument in qemu_bh_delete().

Regards,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg