|
 |
218e99 |
From 65b9fb19d5853b28b6748963d9e0053429655921 Mon Sep 17 00:00:00 2001
|
|
|
218e99 |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
218e99 |
Date: Wed, 18 Sep 2013 09:53:54 +0200
|
|
|
218e99 |
Subject: [PATCH 01/18] chardev: fix pty_chr_timer
|
|
|
218e99 |
|
|
|
218e99 |
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
218e99 |
Message-id: <1379498034-29529-2-git-send-email-kraxel@redhat.com>
|
|
|
218e99 |
Patchwork-id: 54429
|
|
|
218e99 |
O-Subject: [RHEL-7 qemu-kvm PATCH 1/1] chardev: fix pty_chr_timer
|
|
|
218e99 |
Bugzilla: 994414
|
|
|
218e99 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
218e99 |
|
|
|
218e99 |
pty_chr_timer first calls pty_chr_update_read_handler(), then clears
|
|
|
218e99 |
timer_tag (because it is a one-shot timer). This is the wrong order
|
|
|
218e99 |
though. pty_chr_update_read_handler might re-arm time timer, and the
|
|
|
218e99 |
new timer_tag gets overwitten in that case.
|
|
|
218e99 |
|
|
|
218e99 |
This leads to crashes when unplugging a pty chardev: pty_chr_close
|
|
|
218e99 |
thinks no timer is running -> timer isn't canceled -> pty_chr_timer gets
|
|
|
218e99 |
called with stale CharDevState -> BOOM.
|
|
|
218e99 |
|
|
|
218e99 |
This patch fixes the ordering.
|
|
|
218e99 |
Kill the pointless goto while being at it.
|
|
|
218e99 |
|
|
|
218e99 |
https://bugzilla.redhat.com/show_bug.cgi?id=994414
|
|
|
218e99 |
|
|
|
218e99 |
Cc: qemu-stable@nongnu.org
|
|
|
218e99 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
218e99 |
(cherry picked from commit b0d768c35e08d2057b63e8e77e7a513c447199fa)
|
|
|
218e99 |
---
|
|
|
218e99 |
qemu-char.c | 12 ++++--------
|
|
|
218e99 |
1 file changed, 4 insertions(+), 8 deletions(-)
|
|
|
218e99 |
|
|
|
218e99 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
218e99 |
---
|
|
|
218e99 |
qemu-char.c | 12 ++++--------
|
|
|
218e99 |
1 files changed, 4 insertions(+), 8 deletions(-)
|
|
|
218e99 |
|
|
|
218e99 |
diff --git a/qemu-char.c b/qemu-char.c
|
|
|
218e99 |
index 2fb876c..660d758 100644
|
|
|
218e99 |
--- a/qemu-char.c
|
|
|
218e99 |
+++ b/qemu-char.c
|
|
|
218e99 |
@@ -1029,15 +1029,11 @@ static gboolean pty_chr_timer(gpointer opaque)
|
|
|
218e99 |
struct CharDriverState *chr = opaque;
|
|
|
218e99 |
PtyCharDriver *s = chr->opaque;
|
|
|
218e99 |
|
|
|
218e99 |
- if (s->connected) {
|
|
|
218e99 |
- goto out;
|
|
|
218e99 |
- }
|
|
|
218e99 |
-
|
|
|
218e99 |
- /* Next poll ... */
|
|
|
218e99 |
- pty_chr_update_read_handler(chr);
|
|
|
218e99 |
-
|
|
|
218e99 |
-out:
|
|
|
218e99 |
s->timer_tag = 0;
|
|
|
218e99 |
+ if (!s->connected) {
|
|
|
218e99 |
+ /* Next poll ... */
|
|
|
218e99 |
+ pty_chr_update_read_handler(chr);
|
|
|
218e99 |
+ }
|
|
|
218e99 |
return FALSE;
|
|
|
218e99 |
}
|
|
|
218e99 |
|
|
|
218e99 |
--
|
|
|
218e99 |
1.7.1
|
|
|
218e99 |
|