* [PATCH] chardev: fix segfault in finalize
@ 2022-08-25 16:52 Maksim Davydov
2022-08-26 8:21 ` Marc-André Lureau
2022-09-08 10:37 ` Vladimir Sementsov-Ogievskiy
0 siblings, 2 replies; 5+ messages in thread
From: Maksim Davydov @ 2022-08-25 16:52 UTC (permalink / raw)
To: qemu-devel; +Cc: pbonzini, marcandre.lureau, yc-core, davydov-max
If finalize chardev-msmouse or chardev-wctable is called immediately after
init it cases QEMU to crash with segfault. This happens because of
QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
NULL pointer.
For instance, this error can be reproduced via `qom-list-properties`
command.
Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
---
chardev/msmouse.c | 4 +++-
chardev/wctablet.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/chardev/msmouse.c b/chardev/msmouse.c
index eb9231dcdb..2cc1b16561 100644
--- a/chardev/msmouse.c
+++ b/chardev/msmouse.c
@@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj)
{
MouseChardev *mouse = MOUSE_CHARDEV(obj);
- qemu_input_handler_unregister(mouse->hs);
+ if (mouse->hs) {
+ qemu_input_handler_unregister(mouse->hs);
+ }
}
static QemuInputHandler msmouse_handler = {
diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index e8b292c43c..43bdf6b608 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj)
{
TabletChardev *tablet = WCTABLET_CHARDEV(obj);
- qemu_input_handler_unregister(tablet->hs);
+ if (tablet->hs) {
+ qemu_input_handler_unregister(tablet->hs);
+ }
}
static void wctablet_chr_open(Chardev *chr,
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] chardev: fix segfault in finalize
2022-08-25 16:52 [PATCH] chardev: fix segfault in finalize Maksim Davydov
@ 2022-08-26 8:21 ` Marc-André Lureau
2022-09-14 9:31 ` Maksim Davydov
2022-09-20 16:05 ` Maksim Davydov
2022-09-08 10:37 ` Vladimir Sementsov-Ogievskiy
1 sibling, 2 replies; 5+ messages in thread
From: Marc-André Lureau @ 2022-08-26 8:21 UTC (permalink / raw)
To: Maksim Davydov; +Cc: qemu-devel, pbonzini, yc-core
[-- Attachment #1: Type: text/plain, Size: 1687 bytes --]
Hi
On Thu, Aug 25, 2022 at 9:02 PM Maksim Davydov <davydov-max@yandex-team.ru>
wrote:
> If finalize chardev-msmouse or chardev-wctable is called immediately after
> init it cases QEMU to crash with segfault. This happens because of
> QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
> NULL pointer.
> For instance, this error can be reproduced via `qom-list-properties`
> command.
>
> Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> chardev/msmouse.c | 4 +++-
> chardev/wctablet.c | 4 +++-
> 2 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/chardev/msmouse.c b/chardev/msmouse.c
> index eb9231dcdb..2cc1b16561 100644
> --- a/chardev/msmouse.c
> +++ b/chardev/msmouse.c
> @@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj)
> {
> MouseChardev *mouse = MOUSE_CHARDEV(obj);
>
> - qemu_input_handler_unregister(mouse->hs);
> + if (mouse->hs) {
> + qemu_input_handler_unregister(mouse->hs);
> + }
> }
>
> static QemuInputHandler msmouse_handler = {
> diff --git a/chardev/wctablet.c b/chardev/wctablet.c
> index e8b292c43c..43bdf6b608 100644
> --- a/chardev/wctablet.c
> +++ b/chardev/wctablet.c
> @@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj)
> {
> TabletChardev *tablet = WCTABLET_CHARDEV(obj);
>
> - qemu_input_handler_unregister(tablet->hs);
> + if (tablet->hs) {
> + qemu_input_handler_unregister(tablet->hs);
> + }
> }
>
> static void wctablet_chr_open(Chardev *chr,
> --
> 2.25.1
>
>
>
--
Marc-André Lureau
[-- Attachment #2: Type: text/html, Size: 2503 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] chardev: fix segfault in finalize
2022-08-25 16:52 [PATCH] chardev: fix segfault in finalize Maksim Davydov
2022-08-26 8:21 ` Marc-André Lureau
@ 2022-09-08 10:37 ` Vladimir Sementsov-Ogievskiy
1 sibling, 0 replies; 5+ messages in thread
From: Vladimir Sementsov-Ogievskiy @ 2022-09-08 10:37 UTC (permalink / raw)
To: Maksim Davydov, qemu-devel; +Cc: pbonzini, marcandre.lureau, yc-core
On 8/25/22 19:52, Maksim Davydov wrote:
> If finalize chardev-msmouse or chardev-wctable is called immediately after
> init it cases QEMU to crash with segfault. This happens because of
> QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
> NULL pointer.
> For instance, this error can be reproduced via `qom-list-properties`
> command.
>
> Signed-off-by: Maksim Davydov<davydov-max@yandex-team.ru>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
--
Best regards,
Vladimir
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] chardev: fix segfault in finalize
2022-08-26 8:21 ` Marc-André Lureau
@ 2022-09-14 9:31 ` Maksim Davydov
2022-09-20 16:05 ` Maksim Davydov
1 sibling, 0 replies; 5+ messages in thread
From: Maksim Davydov @ 2022-09-14 9:31 UTC (permalink / raw)
To: Marc-André Lureau,
Владимир Семенцов-Огиевский
Cc: qemu-devel@nongnu.org, yc-core@yandex-team.ru
[-- Attachment #1: Type: text/html, Size: 2847 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] chardev: fix segfault in finalize
2022-08-26 8:21 ` Marc-André Lureau
2022-09-14 9:31 ` Maksim Davydov
@ 2022-09-20 16:05 ` Maksim Davydov
1 sibling, 0 replies; 5+ messages in thread
From: Maksim Davydov @ 2022-09-20 16:05 UTC (permalink / raw)
To: Marc-André Lureau
Cc: qemu-devel@nongnu.org, pbonzini@redhat.com,
yc-core@yandex-team.ru
[-- Attachment #1: Type: text/html, Size: 2807 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-09-20 21:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-25 16:52 [PATCH] chardev: fix segfault in finalize Maksim Davydov
2022-08-26 8:21 ` Marc-André Lureau
2022-09-14 9:31 ` Maksim Davydov
2022-09-20 16:05 ` Maksim Davydov
2022-09-08 10:37 ` Vladimir Sementsov-Ogievskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).