From patchwork Mon Aug 22 08:09:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 661371 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3sHmXy2GCGz9stc for ; Mon, 22 Aug 2016 18:13:22 +1000 (AEST) Received: from localhost ([::1]:40220 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bbkMC-0000iM-Be for incoming@patchwork.ozlabs.org; Mon, 22 Aug 2016 04:13:20 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47168) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bbkIg-0006EL-Pr for qemu-devel@nongnu.org; Mon, 22 Aug 2016 04:09:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bbkIa-0007M3-Jr for qemu-devel@nongnu.org; Mon, 22 Aug 2016 04:09:42 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33278) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bbkIa-0007Ly-Du for qemu-devel@nongnu.org; Mon, 22 Aug 2016 04:09:36 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 214AC13D15; Mon, 22 Aug 2016 08:09:36 +0000 (UTC) Received: from jason-ThinkPad-T450s.redhat.com (vpn1-5-97.pek2.redhat.com [10.72.5.97]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u7M89TjC007467; Mon, 22 Aug 2016 04:09:33 -0400 From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Mon, 22 Aug 2016 16:09:26 +0800 Message-Id: <1471853367-18474-2-git-send-email-jasowang@redhat.com> In-Reply-To: <1471853367-18474-1-git-send-email-jasowang@redhat.com> References: <1471853367-18474-1-git-send-email-jasowang@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 22 Aug 2016 08:09:36 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 1/2] slirp: fix segv when init failed X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Jason Wang Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Marc-André Lureau Since commit f6c2e66ae8c8a, slirp uses an exit notifier to call slirp_smb_cleanup. However, if init() failed, the notifier isn't added, and removing it will fail: ==18447== Invalid write of size 8 ==18447== at 0x7EF2B5: notifier_remove (notify.c:32) ==18447== by 0x48E80C: qemu_remove_exit_notifier (vl.c:2661) ==18447== by 0x6A2187: net_slirp_cleanup (slirp.c:134) ==18447== by 0x69419D: qemu_cleanup_net_client (net.c:338) ==18447== by 0x69445B: qemu_del_net_client (net.c:401) ==18447== by 0x6A2B81: net_slirp_init (slirp.c:366) ==18447== by 0x6A4241: net_init_slirp (slirp.c:865) ==18447== by 0x695C6D: net_client_init1 (net.c:1051) ==18447== by 0x695F6E: net_client_init (net.c:1108) ==18447== by 0x696DBA: net_init_netdev (net.c:1498) ==18447== by 0x7F1F99: qemu_opts_foreach (qemu-option.c:1116) ==18447== by 0x696E60: net_init_clients (net.c:1516) ==18447== Address 0x0 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Marc-André Lureau Signed-off-by: Jason Wang --- net/slirp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/slirp.c b/net/slirp.c index facc30e..b60893f 100644 --- a/net/slirp.c +++ b/net/slirp.c @@ -131,7 +131,9 @@ static void net_slirp_cleanup(NetClientState *nc) SlirpState *s = DO_UPCAST(SlirpState, nc, nc); slirp_cleanup(s->slirp); - qemu_remove_exit_notifier(&s->exit_notifier); + if (s->exit_notifier.notify) { + qemu_remove_exit_notifier(&s->exit_notifier); + } slirp_smb_cleanup(s); QTAILQ_REMOVE(&slirp_stacks, s, entry); }