diff options
| author | Klim Kireev <klim.kireev@virtuozzo.com> | 2018-02-07 12:48:44 +0300 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2018-02-16 12:23:54 +0100 |
| commit | d49b87f0d1e0520443a990fc610d0f02bc63c556 (patch) | |
| tree | ecef4d8dededfe2ea53dd3fdaccb4c4141a80bf0 /ui/vnc-jobs.c | |
| parent | 577ce409acd439b7b5ad14935569cfb10bf261f3 (diff) | |
vnc: fix segfault in closed connection handling
On one of our client's node, due to trying to read from closed ioc,
a segmentation fault occured. Corresponding backtrace:
0 object_get_class (obj=obj@entry=0x0)
1 qio_channel_readv_full (ioc=0x0, iov=0x7ffe55277180 ...
2 qio_channel_read (ioc=<optimized out> ...
3 vnc_client_read_buf (vs=vs@entry=0x55625f3c6000, ...
4 vnc_client_read_plain (vs=0x55625f3c6000)
5 vnc_client_read (vs=0x55625f3c6000)
6 vnc_client_io (ioc=<optimized out>, condition=G_IO_IN, ...
7 g_main_dispatch (context=0x556251568a50)
8 g_main_context_dispatch (context=context@entry=0x556251568a50)
9 glib_pollfds_poll ()
10 os_host_main_loop_wait (timeout=<optimized out>)
11 main_loop_wait (nonblocking=nonblocking@entry=0)
12 main_loop () at vl.c:1909
13 main (argc=<optimized out>, argv=<optimized out>, ...
Having analyzed the coredump, I understood that the reason is that
ioc_tag is reset on vnc_disconnect_start and ioc is cleaned
in vnc_disconnect_finish. Between these two events due to some
reasons the ioc_tag was set again and after vnc_disconnect_finish
the handler is running with freed ioc,
which led to the segmentation fault.
The patch checks vs->disconnecting in places where we call
qio_channel_add_watch and resets handler if disconnecting == TRUE
to prevent such an occurrence.
Signed-off-by: Klim Kireev <klim.kireev@virtuozzo.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20180207094844.21402-1-klim.kireev@virtuozzo.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'ui/vnc-jobs.c')
| -rw-r--r-- | ui/vnc-jobs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c index e326679dd0..868dddef4b 100644 --- a/ui/vnc-jobs.c +++ b/ui/vnc-jobs.c @@ -148,8 +148,10 @@ void vnc_jobs_consume_buffer(VncState *vs) if (vs->ioc_tag) { g_source_remove(vs->ioc_tag); } - vs->ioc_tag = qio_channel_add_watch( - vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); + if (vs->disconnecting == FALSE) { + vs->ioc_tag = qio_channel_add_watch( + vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); + } } buffer_move(&vs->output, &vs->jobs_buffer); |