]>
Commit | Line | Data |
---|---|---|
73912aee FE |
1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
2 | From: Maksim Davydov <davydov-max@yandex-team.ru> | |
3 | Date: Thu, 25 Aug 2022 19:52:47 +0300 | |
4 | Subject: [PATCH] chardev: fix segfault in finalize | |
5 | MIME-Version: 1.0 | |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | If finalize chardev-msmouse or chardev-wctable is called immediately after | |
10 | init it cases QEMU to crash with segfault. This happens because of | |
11 | QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference | |
12 | NULL pointer. | |
13 | For instance, this error can be reproduced via `qom-list-properties` | |
14 | command. | |
15 | ||
16 | Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> | |
17 | Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> | |
18 | Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> | |
19 | Message-Id: <20220825165247.33704-1-davydov-max@yandex-team.ru> | |
20 | (trivial backport from fc0c128531ed55f058bfbad4f1348ebd9a0187f2) | |
21 | Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> | |
22 | --- | |
23 | chardev/msmouse.c | 4 +++- | |
24 | chardev/wctablet.c | 4 +++- | |
25 | 2 files changed, 6 insertions(+), 2 deletions(-) | |
26 | ||
27 | diff --git a/chardev/msmouse.c b/chardev/msmouse.c | |
28 | index eb9231dcdb..2cc1b16561 100644 | |
29 | --- a/chardev/msmouse.c | |
30 | +++ b/chardev/msmouse.c | |
31 | @@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj) | |
32 | { | |
33 | MouseChardev *mouse = MOUSE_CHARDEV(obj); | |
34 | ||
35 | - qemu_input_handler_unregister(mouse->hs); | |
36 | + if (mouse->hs) { | |
37 | + qemu_input_handler_unregister(mouse->hs); | |
38 | + } | |
39 | } | |
40 | ||
41 | static QemuInputHandler msmouse_handler = { | |
42 | diff --git a/chardev/wctablet.c b/chardev/wctablet.c | |
43 | index e8b292c43c..43bdf6b608 100644 | |
44 | --- a/chardev/wctablet.c | |
45 | +++ b/chardev/wctablet.c | |
46 | @@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj) | |
47 | { | |
48 | TabletChardev *tablet = WCTABLET_CHARDEV(obj); | |
49 | ||
50 | - qemu_input_handler_unregister(tablet->hs); | |
51 | + if (tablet->hs) { | |
52 | + qemu_input_handler_unregister(tablet->hs); | |
53 | + } | |
54 | } | |
55 | ||
56 | static void wctablet_chr_open(Chardev *chr, |