diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2024-01-05 16:09:52 +0000 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2024-02-09 12:50:26 +0000 |
| commit | cb8ded0f6d919a61ef890be14b28e765fba81f66 (patch) | |
| tree | 8d4f9c0332cf2a0b91b8fa8e3a78c68a73e3d5de /chardev | |
| parent | 30c917b0d82b1e793d0004ef14792369b7cd80df (diff) | |
chardev: close QIOChannel before unref'ing
The chardev socket backend will unref the QIOChannel object while
it is still potentially open. When using TLS there could be a
pending TLS handshake taking place. If the channel is left open
then when the TLS handshake callback runs, it can end up accessing
free'd memory in the tcp_chr_tls_handshake method.
Closing the QIOChannel will unregister any pending handshake
source.
Reported-by: jiangyegen <jiangyegen@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'chardev')
| -rw-r--r-- | chardev/char-socket.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/chardev/char-socket.c b/chardev/char-socket.c index 73947da188..7105753815 100644 --- a/chardev/char-socket.c +++ b/chardev/char-socket.c @@ -378,6 +378,10 @@ static void tcp_chr_free_connection(Chardev *chr) char_socket_yank_iochannel, QIO_CHANNEL(s->sioc)); } + + if (s->ioc) { + qio_channel_close(s->ioc, NULL); + } object_unref(OBJECT(s->sioc)); s->sioc = NULL; object_unref(OBJECT(s->ioc)); |