cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
218e99
From 65b9fb19d5853b28b6748963d9e0053429655921 Mon Sep 17 00:00:00 2001
218e99
From: Gerd Hoffmann <kraxel@redhat.com>
218e99
Date: Wed, 18 Sep 2013 09:53:54 +0200
218e99
Subject: [PATCH 01/18] chardev: fix pty_chr_timer
218e99
218e99
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
218e99
Message-id: <1379498034-29529-2-git-send-email-kraxel@redhat.com>
218e99
Patchwork-id: 54429
218e99
O-Subject: [RHEL-7 qemu-kvm PATCH 1/1] chardev: fix pty_chr_timer
218e99
Bugzilla: 994414
218e99
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
218e99
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
218e99
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
218e99
218e99
pty_chr_timer first calls pty_chr_update_read_handler(), then clears
218e99
timer_tag (because it is a one-shot timer).   This is the wrong order
218e99
though.  pty_chr_update_read_handler might re-arm time timer, and the
218e99
new timer_tag gets overwitten in that case.
218e99
218e99
This leads to crashes when unplugging a pty chardev:  pty_chr_close
218e99
thinks no timer is running -> timer isn't canceled -> pty_chr_timer gets
218e99
called with stale CharDevState -> BOOM.
218e99
218e99
This patch fixes the ordering.
218e99
Kill the pointless goto while being at it.
218e99
218e99
https://bugzilla.redhat.com/show_bug.cgi?id=994414
218e99
218e99
Cc: qemu-stable@nongnu.org
218e99
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
218e99
(cherry picked from commit b0d768c35e08d2057b63e8e77e7a513c447199fa)
218e99
---
218e99
 qemu-char.c | 12 ++++--------
218e99
 1 file changed, 4 insertions(+), 8 deletions(-)
218e99
218e99
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
218e99
---
218e99
 qemu-char.c |   12 ++++--------
218e99
 1 files changed, 4 insertions(+), 8 deletions(-)
218e99
218e99
diff --git a/qemu-char.c b/qemu-char.c
218e99
index 2fb876c..660d758 100644
218e99
--- a/qemu-char.c
218e99
+++ b/qemu-char.c
218e99
@@ -1029,15 +1029,11 @@ static gboolean pty_chr_timer(gpointer opaque)
218e99
     struct CharDriverState *chr = opaque;
218e99
     PtyCharDriver *s = chr->opaque;
218e99
 
218e99
-    if (s->connected) {
218e99
-        goto out;
218e99
-    }
218e99
-
218e99
-    /* Next poll ... */
218e99
-    pty_chr_update_read_handler(chr);
218e99
-
218e99
-out:
218e99
     s->timer_tag = 0;
218e99
+    if (!s->connected) {
218e99
+        /* Next poll ... */
218e99
+        pty_chr_update_read_handler(chr);
218e99
+    }
218e99
     return FALSE;
218e99
 }
218e99
 
218e99
-- 
218e99
1.7.1
218e99