* [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize
@ 2017-02-21 8:18 Li Qiang
2017-02-21 8:32 ` Marc-André Lureau
0 siblings, 1 reply; 4+ messages in thread
From: Li Qiang @ 2017-02-21 8:18 UTC (permalink / raw)
To: pbonzini, marcandre.lureau, qemu-devel; +Cc: Li Qiang
In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
call 'char_spice_finalize'. But as the SpiceChardev is not inserted
in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
Add a detect to avoid it.
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
spice-qemu-char.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 6f46f46..4d1c76e 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
SpiceChardev *s = SPICE_CHARDEV(obj);
vmc_unregister_interface(s);
- QLIST_REMOVE(s, next);
+
+ if (s->next.le_prev) {
+ QLIST_REMOVE(s, next);
+ }
g_free((char *)s->sin.subtype);
#if SPICE_SERVER_VERSION >= 0x000c02
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize
2017-02-21 8:18 [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize Li Qiang
@ 2017-02-21 8:32 ` Marc-André Lureau
2017-03-02 10:20 ` Li Qiang
0 siblings, 1 reply; 4+ messages in thread
From: Marc-André Lureau @ 2017-02-21 8:32 UTC (permalink / raw)
To: Li Qiang; +Cc: pbonzini, marcandre lureau, qemu-devel, Li Qiang
Hi
----- Original Message -----
> In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> Add a detect to avoid it.
>
> Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> spice-qemu-char.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> index 6f46f46..4d1c76e 100644
> --- a/spice-qemu-char.c
> +++ b/spice-qemu-char.c
> @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
> SpiceChardev *s = SPICE_CHARDEV(obj);
>
> vmc_unregister_interface(s);
> - QLIST_REMOVE(s, next);
> +
> + if (s->next.le_prev) {
> + QLIST_REMOVE(s, next);
> + }
>
> g_free((char *)s->sin.subtype);
> #if SPICE_SERVER_VERSION >= 0x000c02
> --
> 1.8.3.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize
2017-02-21 8:32 ` Marc-André Lureau
@ 2017-03-02 10:20 ` Li Qiang
2017-03-02 10:25 ` Paolo Bonzini
0 siblings, 1 reply; 4+ messages in thread
From: Li Qiang @ 2017-03-02 10:20 UTC (permalink / raw)
To: pbonzini
Cc: marcandre lureau, Qemu Developers, Li Qiang,
Marc-André Lureau
Hello Paolo,
Have you queued this patch?
2017-02-21 16:32 GMT+08:00 Marc-André Lureau <mlureau@redhat.com>:
> Hi
>
> ----- Original Message -----
> > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> > call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> > Add a detect to avoid it.
> >
> > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> > ---
> > spice-qemu-char.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> > index 6f46f46..4d1c76e 100644
> > --- a/spice-qemu-char.c
> > +++ b/spice-qemu-char.c
> > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
> > SpiceChardev *s = SPICE_CHARDEV(obj);
> >
> > vmc_unregister_interface(s);
> > - QLIST_REMOVE(s, next);
> > +
> > + if (s->next.le_prev) {
> > + QLIST_REMOVE(s, next);
> > + }
> >
> > g_free((char *)s->sin.subtype);
> > #if SPICE_SERVER_VERSION >= 0x000c02
> > --
> > 1.8.3.1
> >
> >
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize
2017-03-02 10:20 ` Li Qiang
@ 2017-03-02 10:25 ` Paolo Bonzini
0 siblings, 0 replies; 4+ messages in thread
From: Paolo Bonzini @ 2017-03-02 10:25 UTC (permalink / raw)
To: Li Qiang
Cc: marcandre lureau, Qemu Developers, Li Qiang,
Marc-André Lureau
On 02/03/2017 11:20, Li Qiang wrote:
> Hello Paolo,
>
> Have you queued this patch?
No, I thought Gerd would. Queued now.
Paolo
> 2017-02-21 16:32 GMT+08:00 Marc-André Lureau <mlureau@redhat.com
> <mailto:mlureau@redhat.com>>:
>
> Hi
>
> ----- Original Message -----
> > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> > call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> > Add a detect to avoid it.
> >
> > Signed-off-by: Li Qiang <liqiang6-s@360.cn <mailto:liqiang6-s@360.cn>>
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com
> <mailto:marcandre.lureau@redhat.com>>
>
> > ---
> > spice-qemu-char.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> > index 6f46f46..4d1c76e 100644
> > --- a/spice-qemu-char.c
> > +++ b/spice-qemu-char.c
> > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
> > SpiceChardev *s = SPICE_CHARDEV(obj);
> >
> > vmc_unregister_interface(s);
> > - QLIST_REMOVE(s, next);
> > +
> > + if (s->next.le_prev) {
> > + QLIST_REMOVE(s, next);
> > + }
> >
> > g_free((char *)s->sin.subtype);
> > #if SPICE_SERVER_VERSION >= 0x000c02
> > --
> > 1.8.3.1
> >
> >
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-03-02 10:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-21 8:18 [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize Li Qiang
2017-02-21 8:32 ` Marc-André Lureau
2017-03-02 10:20 ` Li Qiang
2017-03-02 10:25 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).