* [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs
@ 2010-01-25 12:54 Stefano Stabellini
2010-01-27 0:07 ` Anthony Liguori
0 siblings, 1 reply; 5+ messages in thread
From: Stefano Stabellini @ 2010-01-25 12:54 UTC (permalink / raw)
To: qemu-devel
Hi all,
this patch fixes another bug in vnc_refresh: calling vnc_update_client
might cause vs to be free()ed, in this case we cannot access vs->next
right after to examine the next item on the list.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
diff --git a/vnc.c b/vnc.c
index cc2a26e..92facde 100644
--- a/vnc.c
+++ b/vnc.c
@@ -2345,7 +2345,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
static void vnc_refresh(void *opaque)
{
VncDisplay *vd = opaque;
- VncState *vs = NULL;
+ VncState *vs = NULL, *vn = NULL;
int has_dirty = 0, rects = 0;
vga_hw_update();
@@ -2354,8 +2354,10 @@ static void vnc_refresh(void *opaque)
vs = vd->clients;
while (vs != NULL) {
+ vn = vs->next;
rects += vnc_update_client(vs, has_dirty);
- vs = vs->next;
+ /* vs might be free()ed here */
+ vs = vn;
}
/* vd->timer could be NULL now if the last client disconnected,
* in this case don't update the timer */
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs
2010-01-25 12:54 [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs Stefano Stabellini
@ 2010-01-27 0:07 ` Anthony Liguori
2010-01-27 9:53 ` Gerd Hoffmann
0 siblings, 1 reply; 5+ messages in thread
From: Anthony Liguori @ 2010-01-27 0:07 UTC (permalink / raw)
To: Stefano Stabellini; +Cc: qemu-devel
On 01/25/2010 06:54 AM, Stefano Stabellini wrote:
> Hi all,
> this patch fixes another bug in vnc_refresh: calling vnc_update_client
> might cause vs to be free()ed, in this case we cannot access vs->next
> right after to examine the next item on the list.
>
> Signed-off-by: Stefano Stabellini<stefano.stabellini@eu.citrix.com>
>
Applied. Thanks.
Regards,
Anthony Liguori
> ---
>
> diff --git a/vnc.c b/vnc.c
> index cc2a26e..92facde 100644
> --- a/vnc.c
> +++ b/vnc.c
> @@ -2345,7 +2345,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
> static void vnc_refresh(void *opaque)
> {
> VncDisplay *vd = opaque;
> - VncState *vs = NULL;
> + VncState *vs = NULL, *vn = NULL;
> int has_dirty = 0, rects = 0;
>
> vga_hw_update();
> @@ -2354,8 +2354,10 @@ static void vnc_refresh(void *opaque)
>
> vs = vd->clients;
> while (vs != NULL) {
> + vn = vs->next;
> rects += vnc_update_client(vs, has_dirty);
> - vs = vs->next;
> + /* vs might be free()ed here */
> + vs = vn;
> }
> /* vd->timer could be NULL now if the last client disconnected,
> * in this case don't update the timer */
>
>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs
2010-01-27 0:07 ` Anthony Liguori
@ 2010-01-27 9:53 ` Gerd Hoffmann
2010-01-27 12:29 ` Stefano Stabellini
0 siblings, 1 reply; 5+ messages in thread
From: Gerd Hoffmann @ 2010-01-27 9:53 UTC (permalink / raw)
To: Anthony Liguori; +Cc: qemu-devel, Stefano Stabellini
On 01/27/10 01:07, Anthony Liguori wrote:
> On 01/25/2010 06:54 AM, Stefano Stabellini wrote:
>> Hi all,
>> this patch fixes another bug in vnc_refresh: calling vnc_update_client
>> might cause vs to be free()ed, in this case we cannot access vs->next
>> right after to examine the next item on the list.
>>
>> Signed-off-by: Stefano Stabellini<stefano.stabellini@eu.citrix.com>
>
> Applied. Thanks.
IMHO this should go to stable too.
cheers,
Gerd
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs
2010-01-27 9:53 ` Gerd Hoffmann
@ 2010-01-27 12:29 ` Stefano Stabellini
2010-01-27 14:08 ` Anthony Liguori
0 siblings, 1 reply; 5+ messages in thread
From: Stefano Stabellini @ 2010-01-27 12:29 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel@nongnu.org, Stefano Stabellini
On Wed, 27 Jan 2010, Gerd Hoffmann wrote:
> On 01/27/10 01:07, Anthony Liguori wrote:
> > On 01/25/2010 06:54 AM, Stefano Stabellini wrote:
> >> Hi all,
> >> this patch fixes another bug in vnc_refresh: calling vnc_update_client
> >> might cause vs to be free()ed, in this case we cannot access vs->next
> >> right after to examine the next item on the list.
> >>
> >> Signed-off-by: Stefano Stabellini<stefano.stabellini@eu.citrix.com>
> >
> > Applied. Thanks.
>
> IMHO this should go to stable too.
>
Yes, good idea.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs
2010-01-27 12:29 ` Stefano Stabellini
@ 2010-01-27 14:08 ` Anthony Liguori
0 siblings, 0 replies; 5+ messages in thread
From: Anthony Liguori @ 2010-01-27 14:08 UTC (permalink / raw)
To: Stefano Stabellini; +Cc: Gerd Hoffmann, qemu-devel@nongnu.org
On 01/27/2010 06:29 AM, Stefano Stabellini wrote:
> On Wed, 27 Jan 2010, Gerd Hoffmann wrote:
>
>> On 01/27/10 01:07, Anthony Liguori wrote:
>>
>>> On 01/25/2010 06:54 AM, Stefano Stabellini wrote:
>>>
>>>> Hi all,
>>>> this patch fixes another bug in vnc_refresh: calling vnc_update_client
>>>> might cause vs to be free()ed, in this case we cannot access vs->next
>>>> right after to examine the next item on the list.
>>>>
>>>> Signed-off-by: Stefano Stabellini<stefano.stabellini@eu.citrix.com>
>>>>
>>> Applied. Thanks.
>>>
>> IMHO this should go to stable too.
>>
>>
> Yes, good idea.
>
Already did.
Regards,
Anthony Liguori
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-01-27 14:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-25 12:54 [Qemu-devel] [PATCH] vnc_refresh: calling vnc_update_client might free vs Stefano Stabellini
2010-01-27 0:07 ` Anthony Liguori
2010-01-27 9:53 ` Gerd Hoffmann
2010-01-27 12:29 ` Stefano Stabellini
2010-01-27 14:08 ` Anthony Liguori
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).