diff options
| author | Maksim Davydov <davydov-max@yandex-team.ru> | 2022-08-25 19:52:47 +0300 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2022-09-29 14:38:05 +0400 |
| commit | fc0c128531ed55f058bfbad4f1348ebd9a0187f2 (patch) | |
| tree | 95223697bf9321195928c7e9d59b9c5f52392dcf /chardev | |
| parent | 769a726ccb9a8ab9b2a05bca648c79b3f80ab8de (diff) | |
chardev: fix segfault in finalize
If finalize chardev-msmouse or chardev-wctable is called immediately after
init it cases QEMU to crash with segfault. This happens because of
QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
NULL pointer.
For instance, this error can be reproduced via `qom-list-properties`
command.
Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20220825165247.33704-1-davydov-max@yandex-team.ru>
Diffstat (limited to 'chardev')
| -rw-r--r-- | chardev/msmouse.c | 4 | ||||
| -rw-r--r-- | chardev/wctablet.c | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/chardev/msmouse.c b/chardev/msmouse.c index 9006703023..ab8fe981d6 100644 --- a/chardev/msmouse.c +++ b/chardev/msmouse.c @@ -247,7 +247,9 @@ static void char_msmouse_finalize(Object *obj) { MouseChardev *mouse = MOUSE_CHARDEV(obj); - qemu_input_handler_unregister(mouse->hs); + if (mouse->hs) { + qemu_input_handler_unregister(mouse->hs); + } fifo8_destroy(&mouse->outbuf); } diff --git a/chardev/wctablet.c b/chardev/wctablet.c index e8b292c43c..43bdf6b608 100644 --- a/chardev/wctablet.c +++ b/chardev/wctablet.c @@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj) { TabletChardev *tablet = WCTABLET_CHARDEV(obj); - qemu_input_handler_unregister(tablet->hs); + if (tablet->hs) { + qemu_input_handler_unregister(tablet->hs); + } } static void wctablet_chr_open(Chardev *chr, |