[Qemu-devel] [PATCH] spice-char: fix segfault in char_spice_finalize

[Qemu-devel] [PATCH] spice-char: fix segfault in char_spice_finalize

[Li Qiang]

In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
call 'char_spice_finalize'. But as the SpiceChardev is not inserted
in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
Add a detect to avoid it.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
 spice-qemu-char.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 6f46f46..15dbf9c 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
     SpiceChardev *s = SPICE_CHARDEV(obj);
 
     vmc_unregister_interface(s);
-    QLIST_REMOVE(s, next);
+
+    if (spice_chars.lh_first) {
+        QLIST_REMOVE(s, next);
+    }
 
     g_free((char *)s->sin.subtype);
 #if SPICE_SERVER_VERSION >= 0x000c02
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH] spice-char: fix segfault in char_spice_finalize

[Marc-André Lureau]

Hi

On Tue, Feb 21, 2017 at 7:38 AM Li Qiang <liq3ea@gmail.com> wrote:

> In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will
> call 'char_spice_finalize'. But as the SpiceChardev is not inserted
> in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault.
> Add a detect to avoid it.
>

> Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> ---
>  spice-qemu-char.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/spice-qemu-char.c b/spice-qemu-char.c
> index 6f46f46..15dbf9c 100644
> --- a/spice-qemu-char.c
> +++ b/spice-qemu-char.c
> @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj)
>      SpiceChardev *s = SPICE_CHARDEV(obj);
>
>      vmc_unregister_interface(s);
> -    QLIST_REMOVE(s, next);
> +
> +    if (spice_chars.lh_first) {
> +        QLIST_REMOVE(s, next);
> +    }
>
>
The condition you added is unrelated. It should rather be "if
(s->next.le_prev)". (there is a similar test in block.c)

     g_free((char *)s->sin.subtype);
>  #if SPICE_SERVER_VERSION >= 0x000c02
> --
> 1.8.3.1
>
>
> --
Marc-André Lureau