Re: [Qemu-devel] [PATCH] msmouse: Fix segfault caused by free the chr before chardev cleanup.

[Paolo Bonzini]

On 15/09/2016 16:31, Lin Ma wrote:
> Segfault happens when leaving qemu with msmouse backend:
> 
>  #0  0x00007fa8526ac975 in raise () at /lib64/libc.so.6
>  #1  0x00007fa8526add8a in abort () at /lib64/libc.so.6
>  #2  0x0000558be78846ab in error_exit (err=16, msg=0x558be799da10 ...
>  #3  0x0000558be7884717 in qemu_mutex_destroy (mutex=0x558be93be750) at ...
>  #4  0x0000558be7549951 in qemu_chr_free_common (chr=0x558be93be750) at ...
>  #5  0x0000558be754999c in qemu_chr_free (chr=0x558be93be750) at ...
>  #6  0x0000558be7549a20 in qemu_chr_delete (chr=0x558be93be750) at ...
>  #7  0x0000558be754a8ef in qemu_chr_cleanup () at qemu-char.c:4643
>  #8  0x0000558be755843e in main (argc=5, argv=0x7ffe925d7118, ...
> 
> The chr was freed by msmouse close callback before chardev cleanup,
> Then qemu_mutex_destroy triggered raise().
> 
> Because freeing chr is handled by qemu_chr_free_common, Remove the free from
> msmouse_chr_close to avoid double free.
> 
> Signed-off-by: Lin Ma <address@hidden>
> ---
>  backends/msmouse.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/backends/msmouse.c b/backends/msmouse.c
> index aeb9055..7690c42 100644
> --- a/backends/msmouse.c
> +++ b/backends/msmouse.c
> @@ -139,7 +139,6 @@ static void msmouse_chr_close (struct CharDriverState 
> *chr)
>  
>      qemu_input_handler_unregister(mouse->hs);
>      g_free(mouse);
> -    g_free(chr);
>  }
>  
>  static QemuInputHandler msmouse_handler = {
> 

Fixes: c1111a24a3358ecd2f17be7c8b117cfe8bc5e5f8
Cc: address@hidden

Queued for 2.8, thanks.

Paolo