qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Michael Roth <mdroth@linux.vnet.ibm.com>
To: qemu-devel@nongnu.org
Cc: qemu-stable@nongnu.org
Subject: [Qemu-devel] [PATCH 03/32] char: remove watch callback on chardev detach from frontend
Date: Wed,  4 Dec 2013 08:34:10 -0600	[thread overview]
Message-ID: <1386167679-13021-4-git-send-email-mdroth@linux.vnet.ibm.com> (raw)
In-Reply-To: <1386167679-13021-1-git-send-email-mdroth@linux.vnet.ibm.com>

From: Amit Shah <amit.shah@redhat.com>

If a frontend device releases the chardev (via unplug), the chr handlers
are set to NULL via qdev's exit callbacks invoking
qemu_chr_add_handlers().  If the chardev had a pending operation, a
callback will be invoked, which will try to access data in the
just-released frontend, causing a segfault.

Ensure the callbacks are disabled when frontends release chardevs.

This was seen when a virtio-serial port was unplugged when heavy
guest->host IO was in progress (causing a callback to be registered).
In the window in which the throttling was active, unplugging ports
caused a qemu segfault.

https://bugzilla.redhat.com/show_bug.cgi?id=985205

CC: <qemu-stable@nongnu.org>
Reported-by: Sibiao Luo <sluo@redhat.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
(cherry picked from commit 386a5a1e0057e220f79c48fe3689e3dfb17f1b09)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
 qemu-char.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/qemu-char.c b/qemu-char.c
index fa00517..fc1c23d 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -193,6 +193,8 @@ void qemu_chr_fe_printf(CharDriverState *s, const char *fmt, ...)
     va_end(ap);
 }
 
+static void remove_fd_in_watch(CharDriverState *chr);
+
 void qemu_chr_add_handlers(CharDriverState *s,
                            IOCanReadHandler *fd_can_read,
                            IOReadHandler *fd_read,
@@ -203,6 +205,7 @@ void qemu_chr_add_handlers(CharDriverState *s,
 
     if (!opaque && !fd_can_read && !fd_read && !fd_event) {
         fe_open = 0;
+        remove_fd_in_watch(s);
     } else {
         fe_open = 1;
     }
-- 
1.7.9.5

  parent reply	other threads:[~2013-12-04 14:35 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-12-04 14:34 [Qemu-devel] Patch Round-up for stable 1.6.2, freeze on 2013-12-06 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 01/32] char: move backends' io watch tag to CharDriverState Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 02/32] char: use common function to disable callbacks on chardev close Michael Roth
2013-12-04 14:34 ` Michael Roth [this message]
2013-12-04 14:34 ` [Qemu-devel] [PATCH 04/32] tests: Fix schema parser test for in-tree build Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 05/32] tests: Update .gitignore for test-int128 and test-bitops Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 06/32] tci: Add implementation of rotl_i64, rotr_i64 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 07/32] bitops: Add rotate functions (rol8, ror8, ...) Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 08/32] misc: Use new rotate functions Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 09/32] qemu-char: Fix potential out of bounds access to local arrays Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 10/32] xen_disk: mark ioreq as mapped before unmapping in error case Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 11/32] vmdk: Fix vmdk_parse_extents Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 12/32] audio: honor QEMU_AUDIO_TIMER_PERIOD instead of waking up every *nano* second Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 13/32] monitor: eliminate monitor_event_state_lock Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 14/32] memory: fix 128 arithmetic in info mtree Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 15/32] Adjust qapi-visit for python-2.4.3 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 16/32] configure: detect endian via compile test Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 17/32] qapi: fix memleak by adding implict struct functions in dealloc visitor Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 18/32] tests: fix memleak in error path test for input visitor Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 19/32] configure: Explicitly set ARFLAGS so we can build with GNU Make 4.0 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 20/32] linux-user: Fix stat64 syscall for SPARC64 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 21/32] virtio-net: only delete bh that existed Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 22/32] exec: fix breakpoint_invalidate when pc may not be translated Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 23/32] Fix pc migration from qemu <= 1.5 Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 24/32] qcow2: count_contiguous_clusters and compression Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 25/32] qcow2: fix possible corruption when reading multiple clusters Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 26/32] vfio-pci: Fix multifunction=on Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 27/32] virtio-net: fix the memory leak in rxfilter_notify() Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 28/32] qom: Fix memory leak in object_property_set_link() Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 29/32] qdev-monitor: Fix crash when device_add is called with abstract driver Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 30/32] qdev-monitor: Unref device when device_add fails Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 31/32] pci: unregister vmstate_pcibus on unplug Michael Roth
2013-12-04 14:34 ` [Qemu-devel] [PATCH 32/32] rng-egd: offset the point when repeatedly read from the buffer Michael Roth
2013-12-05 15:23 ` [Qemu-devel] Patch Round-up for stable 1.6.2, freeze on 2013-12-06 Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1386167679-13021-4-git-send-email-mdroth@linux.vnet.ibm.com \
    --to=mdroth@linux.vnet.ibm.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).