From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33324) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adCS5-0004lp-FI for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:53:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adCS0-0000Ar-JL for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:53:09 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47956) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adCS0-0000An-EL for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:53:04 -0500 From: Jason Wang Date: Tue, 8 Mar 2016 15:52:34 +0800 Message-Id: <1457423564-9724-3-git-send-email-jasowang@redhat.com> In-Reply-To: <1457423564-9724-1-git-send-email-jasowang@redhat.com> References: <1457423564-9724-1-git-send-email-jasowang@redhat.com> Subject: [Qemu-devel] [PULL V2 02/12] net: filter: correctly remove filter from the list during finalization List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: peter.maydell@linaro.org, qemu-devel@nongnu.org Cc: Jason Wang , Yang Hongyang Qemu may crash when we want to add two filters on the same netdev but the initialization of second fails (e.g missing parameters): ./qemu-system-x86_64 -netdev user,id=un0 \ -object filter-buffer,id=f0,netdev=un0,interval=10 \ -object filter-buffer,id=f1,netdev=un0 Segmentation fault (core dumped) This is because we don't check whether or not the filter was in the list of netdev. This patch fixes this. Cc: Yang Hongyang Reviewed-by: Yang Hongyang Signed-off-by: Jason Wang --- net/filter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/filter.c b/net/filter.c index d2a514e..7cdbc6c 100644 --- a/net/filter.c +++ b/net/filter.c @@ -196,7 +196,8 @@ static void netfilter_finalize(Object *obj) nfc->cleanup(nf); } - if (nf->netdev && !QTAILQ_EMPTY(&nf->netdev->filters)) { + if (nf->netdev && !QTAILQ_EMPTY(&nf->netdev->filters) && + nf->next.tqe_prev) { QTAILQ_REMOVE(&nf->netdev->filters, nf, next); } g_free(nf->netdev_id); -- 2.5.0