[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 5/8] chardev: fix qemu_chr_open_fd() being called with fd=-1
From: |
marcandre . lureau |
Subject: |
[PULL 5/8] chardev: fix qemu_chr_open_fd() being called with fd=-1 |
Date: |
Thu, 5 Aug 2021 16:53:28 +0400 |
From: Marc-André Lureau <marcandre.lureau@redhat.com>
The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
cause invalid system calls, as the QIOChannel is assumed to be properly
initialized later on.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
chardev/char-fd.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 743d3989b4..c11b1037f9 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -39,6 +39,10 @@ static int fd_chr_write(Chardev *chr, const uint8_t *buf,
int len)
{
FDChardev *s = FD_CHARDEV(chr);
+ if (!s->ioc_out) {
+ return -1;
+ }
+
return io_channel_send(s->ioc_out, buf, len);
}
@@ -209,15 +213,19 @@ void qemu_chr_open_fd(Chardev *chr,
FDChardev *s = FD_CHARDEV(chr);
char *name;
- s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
- name = g_strdup_printf("chardev-file-in-%s", chr->label);
- qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
- g_free(name);
- s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
- name = g_strdup_printf("chardev-file-out-%s", chr->label);
- qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
- g_free(name);
- qemu_set_nonblock(fd_out);
+ if (fd_in >= 0) {
+ s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
+ name = g_strdup_printf("chardev-file-in-%s", chr->label);
+ qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
+ g_free(name);
+ }
+ if (fd_out >= 0) {
+ s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
+ name = g_strdup_printf("chardev-file-out-%s", chr->label);
+ qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
+ g_free(name);
+ qemu_set_nonblock(fd_out);
+ }
}
static void char_fd_class_init(ObjectClass *oc, void *data)
--
2.32.0.264.g75ae10bc75
- [PULL 0/8] chardev fixes for 6.1, marcandre . lureau, 2021/08/05
- [PULL 1/8] util: fix abstract socket path copy, marcandre . lureau, 2021/08/05
- [PULL 2/8] chardev/socket: print a more correct command-line address, marcandre . lureau, 2021/08/05
- [PULL 3/8] chardev: mark explicitly first argument as poisoned, marcandre . lureau, 2021/08/05
- [PULL 4/8] chardev: fix fd_chr_add_watch() when in != out, marcandre . lureau, 2021/08/05
- [PULL 5/8] chardev: fix qemu_chr_open_fd() being called with fd=-1,
marcandre . lureau <=
- [PULL 6/8] chardev: fix qemu_chr_open_fd() with fd_in==fd_out, marcandre . lureau, 2021/08/05
- [PULL 7/8] chardev: give some context on chardev-add error, marcandre . lureau, 2021/08/05
- [PULL 8/8] chardev: report a simpler error about duplicated id, marcandre . lureau, 2021/08/05
- Re: [PULL 0/8] chardev fixes for 6.1, Peter Maydell, 2021/08/05