Blame SOURCES/kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch

5d360b
From 74eb4b3e1fcc6d36de0116c2fbbaa308191a1ab7 Mon Sep 17 00:00:00 2001
5d360b
From: "Daniel P. Berrange" <berrange@redhat.com>
5d360b
Date: Thu, 8 Feb 2018 17:50:15 +0100
5d360b
Subject: [PATCH 01/27] vnc: Fix qemu crashed when vnc client disconnect
5d360b
 suddenly
5d360b
5d360b
RH-Author: Daniel P. Berrange <berrange@redhat.com>
5d360b
Message-id: <20180208175041.5634-2-berrange@redhat.com>
5d360b
Patchwork-id: 78947
5d360b
O-Subject: [RHEL-7.5 qemu-kvm PATCH v1 01/27] vnc: Fix qemu crashed when vnc client disconnect suddenly
5d360b
Bugzilla: 1527405
5d360b
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
5d360b
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
5d360b
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
5d360b
5d360b
From: "Gonglei (Arei)" <arei.gonglei@huawei.com>
5d360b
5d360b
Hi,
5d360b
5d360b
When I use RealVNC viewer client (http://www.realvnc.com/) to connect vnc server,
5d360b
the client disconnect suddenly, and I click reconnect button immediately, then the Qemu crashed.
5d360b
5d360b
In the function vnc_worker_thread_loop, will call vnc_async_encoding_start
5d360b
to set the local vs->output buffer by global queue's buffer. Then send rectangles to
5d360b
the vnc client call function vnc_send_framebuffer_update. Finally, Under normal circumstances,
5d360b
call vnc_async_encoding_end to set the global queue'buffer by the local vs->output conversely.
5d360b
5d360b
When the vnc client disconnect, the job->vs->csock will be set to -1. And the current prcoess
5d360b
logic will goto disconnected partion without call function vnc_async_encoding_end.
5d360b
But, the function vnc_send_framebuffer_update will call buffer_reserve, which
5d360b
maybe call g_realloc reset the local vs's buffer, meaning the global queue's buffer is modified also.
5d360b
If anyone use the original global queue's buffer memory will cause corruption and then crash qemu.
5d360b
5d360b
This patch assure the function vnc_async_encoding_end being called
5d360b
even though the vnc client disconnect suddenly.
5d360b
5d360b
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
5d360b
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5d360b
(cherry picked from commit e3c1adf16e38714ebd761dd02517dd07760ba6d2)
5d360b
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
5d360b
---
5d360b
 ui/vnc-jobs.c | 5 +++++
5d360b
 1 file changed, 5 insertions(+)
5d360b
5d360b
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c
5d360b
index 2d3fce8..a141f40 100644
5d360b
--- a/ui/vnc-jobs.c
5d360b
+++ b/ui/vnc-jobs.c
5d360b
@@ -252,6 +252,8 @@ static int vnc_worker_thread_loop(VncJobQueue *queue)
5d360b
 
5d360b
         if (job->vs->csock == -1) {
5d360b
             vnc_unlock_display(job->vs->vd);
5d360b
+            /* Copy persistent encoding data */
5d360b
+            vnc_async_encoding_end(job->vs, &vs);
5d360b
             goto disconnected;
5d360b
         }
5d360b
 
5d360b
@@ -278,6 +280,9 @@ static int vnc_worker_thread_loop(VncJobQueue *queue)
5d360b
         vnc_async_encoding_end(job->vs, &vs);
5d360b
 
5d360b
 	qemu_bh_schedule(job->vs->bh);
5d360b
+    }  else {
5d360b
+        /* Copy persistent encoding data */
5d360b
+        vnc_async_encoding_end(job->vs, &vs);
5d360b
     }
5d360b
     vnc_unlock_output(job->vs);
5d360b
 
5d360b
-- 
5d360b
1.8.3.1
5d360b