mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chardev: fix qemu_chr_open_fd() being called with fd=-1

Browse Source 
The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
cause invalid system calls, as the QIOChannel is assumed to be properly
initialized later on.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Marc-André Lureau 2021-07-23 13:54:54 +04:00
parent bb2b058f1a
commit 46fe3ff6ea
1 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
chardev/char-fd.c
View File

@ -39,6 +39,10 @@ static int fd_chr_write(Chardev *chr, const uint8_t *buf, int len)
{
FDChardev *s = FD_CHARDEV(chr);
if (!s->ioc_out) {
return -1;
}
return io_channel_send(s->ioc_out, buf, len);
}
@ -209,15 +213,19 @@ void qemu_chr_open_fd(Chardev *chr,
FDChardev *s = FD_CHARDEV(chr);
char *name;
s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
name = g_strdup_printf("chardev-file-in-%s", chr->label);
qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
g_free(name);
s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
name = g_strdup_printf("chardev-file-out-%s", chr->label);
qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
g_free(name);
qemu_set_nonblock(fd_out);
if (fd_in >= 0) {
s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
name = g_strdup_printf("chardev-file-in-%s", chr->label);
qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
g_free(name);
}
if (fd_out >= 0) {
s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
name = g_strdup_printf("chardev-file-out-%s", chr->label);
qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
g_free(name);
qemu_set_nonblock(fd_out);
}
}
static void char_fd_class_init(ObjectClass *oc, void *data)