Attachment 44072 Details for Bug 34971 – server/input: avoid double free() of RedChannel on disconnect

[patch] server/input: avoid double free() of RedChannel on disconnect

serverinput-avoid-double-free-of-RedChannel-on-dis.patch (text/plain), 3.62 KB, created by Marc-Andre Lureau on 2011-03-03 05:11:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marc-Andre Lureau

Created: 2011-03-03 05:11:39 UTC

Size: 3.62 KB

patch

obsolete

>From 981d30a1c6e507a0a69b7b5be2c903c300507609 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
>Date: Thu, 3 Mar 2011 13:56:00 +0100
>Subject: [PATCH] server/input: avoid double free() of RedChannel on disconnect
>
>Current master is calling red_channel_destroy() on incoming error, but
>reds Channels still references it, which causes a double free() later
>on (see valgrind report below).
>
>Instead, on error condition, do like the rest of the channels and call
>reds_disconnect(), which remove the references and call shutdown(),
>which then call red_channel_destroy() and finally free the channel
>with red_channel_destroy().
>
>Note: the previous code intention was certainly to be able to keep the
>rest of the channels connected when input channel has errors. This is
>not addressed by this patch.
>
>red_channel_shutdown:
>==29792== Invalid read of size 8
>==29792==    at 0x4C6F063: red_channel_shutdown (red_channel.c:460)
>==29792==    by 0x4C51EFA: inputs_shutdown (inputs_channel.c:463)
>==29792==    by 0x4C48445: reds_shatdown_channels (reds.c:539)
>==29792==    by 0x4C4868A: reds_disconnect (reds.c:603)
>==29792==    by 0x4C519E9: main_channel_on_error (main_channel.c:765)
>==29792==    by 0x4C6E80A: red_channel_peer_on_incoming_error (red_channel.c:215)
>==29792==    by 0x4C6E22D: red_peer_handle_incoming (red_channel.c:87)
>==29792==    by 0x4C6E551: red_channel_receive (red_channel.c:154)
>==29792==    by 0x4C6F329: red_channel_event (red_channel.c:531)
>==29792==    by 0x41CB8C: main_loop_wait (vl.c:1365)
>==29792==    by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589)
>==29792==    by 0x41FE9A: main (vl.c:1411)
>==29792==  Address 0x30b0f6d0 is 0 bytes inside a block of size 28,648 free'd
>==29792==    at 0x4A05372: free (vg_replace_malloc.c:366)
>==29792==    by 0x4C6F032: red_channel_destroy (red_channel.c:454)
>==29792==    by 0x4C6E80A: red_channel_peer_on_incoming_error (red_channel.c:215)
>==29792==    by 0x4C6E22D: red_peer_handle_incoming (red_channel.c:87)
>==29792==    by 0x4C6E551: red_channel_receive (red_channel.c:154)
>==29792==    by 0x4C6F329: red_channel_event (red_channel.c:531)
>==29792==    by 0x41CB8C: main_loop_wait (vl.c:1365)
>==29792==    by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589)
>==29792==    by 0x41FE9A: main (vl.c:1411)
>
>https://bugs.freedesktop.org/show_bug.cgi?id=34971
>---
> server/inputs_channel.c |   12 ++++--------
> 1 files changed, 4 insertions(+), 8 deletions(-)
>
>diff --git a/server/inputs_channel.c b/server/inputs_channel.c
>index d6bcf9d..213f8a0 100644
>--- a/server/inputs_channel.c
>+++ b/server/inputs_channel.c
>@@ -443,14 +443,9 @@ static void inputs_relase_keys(void)
>     kbd_push_scan(keyboard, 0x38 | 0x80); //LALT
> }
> 
>-static void inputs_channel_on_incoming_error(RedChannel *channel)
>+static void inputs_channel_on_error(RedChannel *channel)
> {
>     inputs_relase_keys();
>-    red_channel_destroy(channel);
>-}
>-
>-static void inputs_channel_on_outgoing_error(RedChannel *channel)
>-{
>     reds_disconnect();
> }
> 
>@@ -461,6 +456,7 @@ static void inputs_shutdown(Channel *channel)
> 
>     if (inputs_channel) {
>         red_channel_shutdown(&inputs_channel->base);
>+        red_channel_destroy(&inputs_channel->base);
>         channel->data = NULL;
>         g_inputs_channel = NULL;
>     }
>@@ -528,8 +524,8 @@ static void inputs_link(Channel *channel, RedsStream *stream, int migration,
>         ,inputs_channel_hold_pipe_item
>         ,inputs_channel_send_item
>         ,inputs_channel_release_pipe_item
>-        ,inputs_channel_on_incoming_error
>-        ,inputs_channel_on_outgoing_error
>+        ,inputs_channel_on_error
>+        ,inputs_channel_on_error
>         ,NULL
>         ,NULL
>         ,NULL);
>-- 
>1.7.4

Actions: View | Splinter Review

Attachments on bug 34971: 44071 | 44072

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.