david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vnc: fix segfault in closed connection handling

Browse Source 
On one of our client's node, due to trying to read from closed ioc,
a segmentation fault occured. Corresponding backtrace:

0  object_get_class (obj=obj@entry=0x0)
1  qio_channel_readv_full (ioc=0x0, iov=0x7ffe55277180 ...
2  qio_channel_read (ioc=<optimized out> ...
3  vnc_client_read_buf (vs=vs@entry=0x55625f3c6000, ...
4  vnc_client_read_plain (vs=0x55625f3c6000)
5  vnc_client_read (vs=0x55625f3c6000)
6  vnc_client_io (ioc=<optimized out>, condition=G_IO_IN, ...
7  g_main_dispatch (context=0x556251568a50)
8  g_main_context_dispatch (context=context@entry=0x556251568a50)
9  glib_pollfds_poll ()
10 os_host_main_loop_wait (timeout=<optimized out>)
11 main_loop_wait (nonblocking=nonblocking@entry=0)
12 main_loop () at vl.c:1909
13 main (argc=<optimized out>, argv=<optimized out>, ...

Having analyzed the coredump, I understood that the reason is that
ioc_tag is reset on vnc_disconnect_start and ioc is cleaned
in vnc_disconnect_finish. Between these two events due to some
reasons the ioc_tag was set again and after vnc_disconnect_finish
the handler is running with freed ioc,
which led to the segmentation fault.

The patch checks vs->disconnecting in places where we call
qio_channel_add_watch and resets handler if disconnecting == TRUE
to prevent such an occurrence.

Signed-off-by: Klim Kireev <klim.kireev@virtuozzo.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20180207094844.21402-1-klim.kireev@virtuozzo.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Klim Kireev 2018-02-07 12:48:44 +03:00 committed by Gerd Hoffmann
parent 577ce409ac
commit d49b87f0d1
2 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ui/vnc-jobs.c
View File

@ -148,9 +148,11 @@ void vnc_jobs_consume_buffer(VncState *vs)
if (vs->ioc_tag) { if (vs->ioc_tag) {
g_source_remove(vs->ioc_tag); g_source_remove(vs->ioc_tag);
} }
if (vs->disconnecting == FALSE) {
vs->ioc_tag = qio_channel_add_watch( vs->ioc_tag = qio_channel_add_watch(
vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
} }
}
buffer_move(&vs->output, &vs->jobs_buffer); buffer_move(&vs->output, &vs->jobs_buffer);
if (vs->job_update == VNC_STATE_UPDATE_FORCE) { if (vs->job_update == VNC_STATE_UPDATE_FORCE) {

15
ui/vnc.c
View File

@ -1536,12 +1536,19 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
VncState *vs = opaque; VncState *vs = opaque;
if (condition & G_IO_IN) { if (condition & G_IO_IN) {
if (vnc_client_read(vs) < 0) { if (vnc_client_read(vs) < 0) {
return TRUE; goto end;
} }
} }
if (condition & G_IO_OUT) { if (condition & G_IO_OUT) {
vnc_client_write(vs); vnc_client_write(vs);
} }
end:
if (vs->disconnecting) {
if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag);
}
vs->ioc_tag = 0;
}
return TRUE; return TRUE;
} }
@ -1630,6 +1637,12 @@ void vnc_flush(VncState *vs)
if (vs->ioc != NULL && vs->output.offset) { if (vs->ioc != NULL && vs->output.offset) {
vnc_client_write_locked(vs); vnc_client_write_locked(vs);
} }
if (vs->disconnecting) {
if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag);
}
vs->ioc_tag = 0;
}
vnc_unlock_output(vs); vnc_unlock_output(vs);
} }