[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 1/4] chardev: fix qemu_chr_open_fd() being called with fd=-1
From: |
Daniel P . Berrangé |
Subject: |
Re: [PATCH 1/4] chardev: fix qemu_chr_open_fd() being called with fd=-1 |
Date: |
Tue, 3 Aug 2021 09:40:41 +0100 |
User-agent: |
Mutt/2.0.7 (2021-05-04) |
On Fri, Jul 23, 2021 at 02:28:22PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
> cause invalid system calls, as the QIOChannel is assumed to be properly
> initialized later on.
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> chardev/char-fd.c | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/chardev/char-fd.c b/chardev/char-fd.c
> index 1cd62f2779..ee85a52c06 100644
> --- a/chardev/char-fd.c
> +++ b/chardev/char-fd.c
> @@ -133,15 +133,19 @@ void qemu_chr_open_fd(Chardev *chr,
> FDChardev *s = FD_CHARDEV(chr);
> char *name;
>
> - s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> - name = g_strdup_printf("chardev-file-in-%s", chr->label);
> - qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> - g_free(name);
> - s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> - name = g_strdup_printf("chardev-file-out-%s", chr->label);
> - qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> - g_free(name);
> - qemu_set_nonblock(fd_out);
> + if (fd_in >= 0) {
> + s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
> + name = g_strdup_printf("chardev-file-in-%s", chr->label);
> + qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
> + g_free(name);
> + }
> + if (fd_out >= 0) {
> + s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
> + name = g_strdup_printf("chardev-file-out-%s", chr->label);
> + qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
> + g_free(name);
> + qemu_set_nonblock(fd_out);
> + }
Other code in this file assumes ioc_out is non-NULL, so this looks
like an incomplete fix.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
- Re: [PATCH 1/4] chardev: fix qemu_chr_open_fd() being called with fd=-1,
Daniel P . Berrangé <=