[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_final
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH v2] spice-char: fix segfault in char_spice_finalize |
Date: |
Thu, 2 Mar 2017 11:25:08 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 |
On 02/03/2017 11:20, Li Qiang wrote:
> Hello Paolo,
>
> Have you queued this patch?
No, I thought Gerd would. Queued now.
Paolo
> 2017-02-21 16:32 GMT+08:00 Marc-André Lureau <address@hidden
> <mailto:address@hidden>>:
>
> Hi
>
> ----- Original Message -----
> > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> > call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> > Add a detect to avoid it.
> >
> > Signed-off-by: Li Qiang <address@hidden <mailto:address@hidden>>
>
> Reviewed-by: Marc-André Lureau <address@hidden
> <mailto:address@hidden>>
>
> > ---
> > spice-qemu-char.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> > index 6f46f46..4d1c76e 100644
> > --- a/spice-qemu-char.c
> > +++ b/spice-qemu-char.c
> > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
> > SpiceChardev *s = SPICE_CHARDEV(obj);
> >
> > vmc_unregister_interface(s);
> > - QLIST_REMOVE(s, next);
> > +
> > + if (s->next.le_prev) {
> > + QLIST_REMOVE(s, next);
> > + }
> >
> > g_free((char *)s->sin.subtype);
> > #if SPICE_SERVER_VERSION >= 0x000c02
> > --
> > 1.8.3.1
> >
> >
>
>