| Message ID | 1487648239-83616-1-git-send-email-liqiang6-s@360.cn |
|---|---|
| State | New |
| Headers | show |
Hi On Tue, Feb 21, 2017 at 7:38 AM Li Qiang <liq3ea@gmail.com> wrote: > In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will > call 'char_spice_finalize'. But as the SpiceChardev is not inserted > in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault. > Add a detect to avoid it. > > Signed-off-by: Li Qiang <liqiang6-s@360.cn> > --- > spice-qemu-char.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/spice-qemu-char.c b/spice-qemu-char.c > index 6f46f46..15dbf9c 100644 > --- a/spice-qemu-char.c > +++ b/spice-qemu-char.c > @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj) > SpiceChardev *s = SPICE_CHARDEV(obj); > > vmc_unregister_interface(s); > - QLIST_REMOVE(s, next); > + > + if (spice_chars.lh_first) { > + QLIST_REMOVE(s, next); > + } > > The condition you added is unrelated. It should rather be "if (s->next.le_prev)". (there is a similar test in block.c) g_free((char *)s->sin.subtype); > #if SPICE_SERVER_VERSION >= 0x000c02 > -- > 1.8.3.1 > > > -- Marc-André Lureau
diff --git a/spice-qemu-char.c b/spice-qemu-char.c index 6f46f46..15dbf9c 100644 --- a/spice-qemu-char.c +++ b/spice-qemu-char.c @@ -215,7 +215,10 @@ static void char_spice_finalize(Object *obj) SpiceChardev *s = SPICE_CHARDEV(obj); vmc_unregister_interface(s); - QLIST_REMOVE(s, next); + + if (spice_chars.lh_first) { + QLIST_REMOVE(s, next); + } g_free((char *)s->sin.subtype); #if SPICE_SERVER_VERSION >= 0x000c02
In 'qemu_chr_open_spice_vmc' if the 'psubtype' is NULL, it will call 'char_spice_finalize'. But as the SpiceChardev is not inserted in the 'spice_chars' list, the 'QLIST_REMOVE' will cause a segfault. Add a detect to avoid it. Signed-off-by: Li Qiang <liqiang6-s@360.cn> --- spice-qemu-char.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)