[Qemu-devel] [RFC] monitor: fix segfault from uninitialized lexer->emit

[Qemu-devel] [RFC] monitor: fix segfault from uninitialized lexer->emit

[Alon Levy]

The following triggers a call to monitor_control_read before
monitor_control_event has been called. This patch is misplaced but
fixes the problem by moving the json_message_parser_init call before
setting the chardev handlers.

(echo '{"execute": "qmp_capabilities"}'; echo '{"execute":"query-spice"}'; echo '{ "execute": "quit" }') | qemu-system-x86_64 -spice port=9999 -qmp stdio

Signed-off-by: Alon Levy <alevy@redhat.com>
---
 monitor.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/monitor.c b/monitor.c
index 1b8ba2c..6e3d970 100644
--- a/monitor.c
+++ b/monitor.c
@@ -5190,8 +5190,6 @@ static void monitor_control_event(void *opaque, int event)
 
     switch (event) {
     case CHR_EVENT_OPENED:
-        mon->mc->command_mode = 0;
-        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
         data = get_qmp_greeting();
         monitor_json_emitter(mon, data);
         qobject_decref(data);
@@ -5272,6 +5270,8 @@ void monitor_init(CharDriverState *chr, int flags)
 
     if (monitor_ctrl_mode(mon)) {
         mon->mc = qemu_mallocz(sizeof(MonitorControl));
+        mon->mc->command_mode = 0;
+        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
         /* Control mode requires special handlers */
         qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
                               monitor_control_event, mon);
-- 
1.7.6

Re: [Qemu-devel] [RFC] monitor: fix segfault from uninitialized lexer->emit

[Luiz Capitulino]

On Wed, 10 Aug 2011 11:20:09 +0300
Alon Levy <alevy@redhat.com> wrote:

> The following triggers a call to monitor_control_read before
> monitor_control_event has been called. This patch is misplaced but
> fixes the problem by moving the json_message_parser_init call before
> setting the chardev handlers.
> 
> (echo '{"execute": "qmp_capabilities"}'; echo '{"execute":"query-spice"}'; echo '{ "execute": "quit" }') | qemu-system-x86_64 -spice port=9999 -qmp stdio

What's happening is that the CHR_EVENT_OPENED event is not being emitted. I took
a look at the code and it's not clear to me why.

Does anyone know if this is expected or is it a bug in the chardev layer?

> 
> Signed-off-by: Alon Levy <alevy@redhat.com>
> ---
>  monitor.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/monitor.c b/monitor.c
> index 1b8ba2c..6e3d970 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -5190,8 +5190,6 @@ static void monitor_control_event(void *opaque, int event)
>  
>      switch (event) {
>      case CHR_EVENT_OPENED:
> -        mon->mc->command_mode = 0
> -        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
>          data = get_qmp_greeting();
>          monitor_json_emitter(mon, data);
>          qobject_decref(data);
> @@ -5272,6 +5270,8 @@ void monitor_init(CharDriverState *chr, int flags)
>  
>      if (monitor_ctrl_mode(mon)) {
>          mon->mc = qemu_mallocz(sizeof(MonitorControl));
> +        mon->mc->command_mode = 0;
> +        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
>          /* Control mode requires special handlers */
>          qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
>                                monitor_control_event, mon);