From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36103) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVaS6-0002YY-GZ for qemu-devel@nongnu.org; Fri, 05 Aug 2016 04:25:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bVaS5-0002Oi-BA for qemu-devel@nongnu.org; Fri, 05 Aug 2016 04:25:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53478) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVaS5-0002Oe-2b for qemu-devel@nongnu.org; Fri, 05 Aug 2016 04:25:57 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A4E7663707 for ; Fri, 5 Aug 2016 08:25:56 +0000 (UTC) From: marcandre.lureau@redhat.com Date: Fri, 5 Aug 2016 12:24:04 +0400 Message-Id: <20160805082421.21994-20-marcandre.lureau@redhat.com> In-Reply-To: <20160805082421.21994-1-marcandre.lureau@redhat.com> References: <20160805082421.21994-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH for-2.7 v4 19/36] char: free the tcp connection data when closing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, eblake@redhat.com, armbru@redhat.com, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= From: Marc-Andr=C3=A9 Lureau Make sure the connection data got freed when closing the chardev, to avoid leaks. Introduce tcp_chr_free_connection() to clean all connection related data, and move some tcp_chr_close() clean-ups there. (while at it, set write_msgfds_num to 0 when clearing array in tcp_set_msgfds()) Signed-off-by: Marc-Andr=C3=A9 Lureau --- qemu-char.c | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/qemu-char.c b/qemu-char.c index a50b8fb..f20d385 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2763,6 +2763,7 @@ static int tcp_set_msgfds(CharDriverState *chr, int= *fds, int num) /* clear old pending fd array */ g_free(s->write_msgfds); s->write_msgfds =3D NULL; + s->write_msgfds_num =3D 0; =20 if (!s->connected || !qio_channel_has_feature(s->ioc, @@ -2843,19 +2844,24 @@ static GSource *tcp_chr_add_watch(CharDriverState= *chr, GIOCondition cond) return qio_channel_create_watch(s->ioc, cond); } =20 -static void tcp_chr_disconnect(CharDriverState *chr) +static void tcp_chr_free_connection(CharDriverState *chr) { TCPCharDriver *s =3D chr->opaque; + int i; =20 if (!s->connected) { return; } =20 - s->connected =3D 0; - if (s->listen_ioc) { - s->listen_tag =3D qio_channel_add_watch( - QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NU= LL); + if (s->read_msgfds_num) { + for (i =3D 0; i < s->read_msgfds_num; i++) { + close(s->read_msgfds[i]); + } + g_free(s->read_msgfds); + s->read_msgfds =3D NULL; + s->read_msgfds_num =3D 0; } + tcp_set_msgfds(chr, NULL, 0); remove_fd_in_watch(chr); object_unref(OBJECT(s->sioc)); @@ -2863,6 +2869,24 @@ static void tcp_chr_disconnect(CharDriverState *ch= r) object_unref(OBJECT(s->ioc)); s->ioc =3D NULL; g_free(chr->filename); + chr->filename =3D NULL; + s->connected =3D 0; +} + +static void tcp_chr_disconnect(CharDriverState *chr) +{ + TCPCharDriver *s =3D chr->opaque; + + if (!s->connected) { + return; + } + + tcp_chr_free_connection(chr); + + if (s->listen_ioc) { + s->listen_tag =3D qio_channel_add_watch( + QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NU= LL); + } chr->filename =3D SocketAddress_to_str("disconnected:", s->addr, s->is_listen, s->is_telnet); qemu_chr_be_event(chr, CHR_EVENT_CLOSED); @@ -3177,17 +3201,14 @@ int qemu_chr_wait_connected(CharDriverState *chr,= Error **errp) static void tcp_chr_close(CharDriverState *chr) { TCPCharDriver *s =3D chr->opaque; - int i; + + tcp_chr_free_connection(chr); =20 if (s->reconnect_timer) { g_source_remove(s->reconnect_timer); s->reconnect_timer =3D 0; } qapi_free_SocketAddress(s->addr); - remove_fd_in_watch(chr); - if (s->ioc) { - object_unref(OBJECT(s->ioc)); - } if (s->listen_tag) { g_source_remove(s->listen_tag); s->listen_tag =3D 0; @@ -3195,18 +3216,9 @@ static void tcp_chr_close(CharDriverState *chr) if (s->listen_ioc) { object_unref(OBJECT(s->listen_ioc)); } - if (s->read_msgfds_num) { - for (i =3D 0; i < s->read_msgfds_num; i++) { - close(s->read_msgfds[i]); - } - g_free(s->read_msgfds); - } if (s->tls_creds) { object_unref(OBJECT(s->tls_creds)); } - if (s->write_msgfds_num) { - g_free(s->write_msgfds); - } g_free(s); qemu_chr_be_event(chr, CHR_EVENT_CLOSED); } --=20 2.9.0