The IOWatchPoll holds a reference to the iochannel while the "child"
source (iwp->src) is removed from the context and freed. Freeing the
source leads to the iochannel being also freed at
qio_channel_fd_source_finalize().
Later, io_watch_poll_prepare() tries to create another source with the
same iochannel and hits an use after free:
==8241==ERROR: AddressSanitizer: heap-use-after-free on address 0x514000000040
READ of size 8 at 0x514000000040 thread T2
#0 0x561c2d272fcd in object_get_class ../qom/object.c:1043:17
#1 0x561c2d338f84 in QIO_CHANNEL_GET_CLASS include/io/channel.h:29:1
#2 0x561c2d33b26f in qio_channel_create_watch ../io/channel.c:388:30
#3 0x561c2d2f0993 in io_watch_poll_prepare ../chardev/char-io.c:65:20
...
0x514000000040 is located 0 bytes inside of 392-byte region [0x514000000040,0x5140000001c8)
freed by thread T2 here:
#0 0x561c2d2319a5 in free
#1 0x7fb2c0926638 in g_free
#2 0x561c2d276507 in object_finalize ../qom/object.c:734:9
#3 0x561c2d271d0d in object_unref ../qom/object.c:1231:9
#4 0x561c2d32ef1d in qio_channel_fd_source_finalize ../io/channel-watch.c:95:5
#5 0x7fb2c091d124 in g_source_unref_internal ../glib/gmain.c:2298
#6 0x561c2d2f0b6c in io_watch_poll_prepare ../chardev/char-io.c:71:9
...
previously allocated by thread T3 (connect) here:
#0 0x561c2d231c69 in malloc
#1 0x7fb2c0926518 in g_malloc
#2 0x561c2d27246e in object_new_with_type ../qom/object.c:767:15
#3 0x561c2d272530 in object_new ../qom/object.c:789:12
#4 0x561c2d320193 in qio_channel_socket_new ../io/channel-socket.c:64:31
#5 0x561c2d308013 in tcp_chr_connect_client_async ../chardev/char-socket.c:1181:12
#6 0x561c2d3002e7 in qmp_chardev_open_socket_client ../chardev/char-socket.c:1281:9
...
Fix the issue by incrementing the iochannel reference count when the
IOWatchPoll takes a reference and decrementing when it is finalized.
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260302092225.4088227-6-peter.maydell@linaro.org
[PMM: rebased]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
198 lines
5.6 KiB
C
198 lines
5.6 KiB
C
/*
|
|
* QEMU System Emulator
|
|
*
|
|
* Copyright (c) 2003-2008 Fabrice Bellard
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*/
|
|
#include "qemu/osdep.h"
|
|
#include "chardev/char-io.h"
|
|
|
|
typedef struct IOWatchPoll {
|
|
GSource parent;
|
|
|
|
QIOChannel *ioc;
|
|
GSource *src;
|
|
|
|
IOCanReadHandler *fd_can_read;
|
|
GSourceFunc fd_read;
|
|
void *opaque;
|
|
GMainContext *context;
|
|
} IOWatchPoll;
|
|
|
|
static IOWatchPoll *io_watch_poll_from_source(GSource *source)
|
|
{
|
|
return container_of(source, IOWatchPoll, parent);
|
|
}
|
|
|
|
static gboolean io_watch_poll_prepare(GSource *source,
|
|
gint *timeout)
|
|
{
|
|
IOWatchPoll *iwp = io_watch_poll_from_source(source);
|
|
bool now_active = iwp->fd_can_read(iwp->opaque) > 0;
|
|
bool was_active = iwp->src != NULL;
|
|
if (was_active == now_active) {
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* We do not register the QIOChannel watch as a child GSource.
|
|
* The 'prepare' function on the parent GSource will be
|
|
* skipped if a child GSource's 'prepare' function indicates
|
|
* readiness. We need this prepare function be guaranteed
|
|
* to run on *every* iteration of the main loop, because
|
|
* it is critical to ensure we remove the QIOChannel watch
|
|
* if 'fd_can_read' indicates the frontend cannot receive
|
|
* more data.
|
|
*/
|
|
if (now_active) {
|
|
iwp->src = qio_channel_create_watch(
|
|
iwp->ioc, G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL);
|
|
g_source_set_callback(iwp->src, iwp->fd_read, iwp->opaque, NULL);
|
|
g_source_attach(iwp->src, iwp->context);
|
|
} else {
|
|
g_source_destroy(iwp->src);
|
|
g_source_unref(iwp->src);
|
|
iwp->src = NULL;
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
static gboolean io_watch_poll_check(GSource *source)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
|
|
gpointer user_data)
|
|
{
|
|
abort();
|
|
}
|
|
|
|
static void io_watch_poll_finalize(GSource *source)
|
|
{
|
|
IOWatchPoll *iwp = io_watch_poll_from_source(source);
|
|
|
|
object_unref(OBJECT(iwp->ioc));
|
|
|
|
if (iwp->src) {
|
|
g_source_destroy(iwp->src);
|
|
g_source_unref(iwp->src);
|
|
iwp->src = NULL;
|
|
}
|
|
}
|
|
|
|
static GSourceFuncs io_watch_poll_funcs = {
|
|
.prepare = io_watch_poll_prepare,
|
|
.check = io_watch_poll_check,
|
|
.dispatch = io_watch_poll_dispatch,
|
|
.finalize = io_watch_poll_finalize,
|
|
};
|
|
|
|
GSource *io_add_watch_poll(Chardev *chr,
|
|
QIOChannel *ioc,
|
|
IOCanReadHandler *fd_can_read,
|
|
QIOChannelFunc fd_read,
|
|
gpointer user_data,
|
|
GMainContext *context)
|
|
{
|
|
IOWatchPoll *iwp;
|
|
char *name;
|
|
|
|
iwp = (IOWatchPoll *) g_source_new(&io_watch_poll_funcs,
|
|
sizeof(IOWatchPoll));
|
|
iwp->fd_can_read = fd_can_read;
|
|
iwp->opaque = user_data;
|
|
iwp->ioc = ioc;
|
|
object_ref(OBJECT(iwp->ioc));
|
|
|
|
iwp->fd_read = (GSourceFunc) fd_read;
|
|
iwp->src = NULL;
|
|
iwp->context = context;
|
|
|
|
name = g_strdup_printf("chardev-iowatch-%s", chr->label);
|
|
g_source_set_name((GSource *)iwp, name);
|
|
g_free(name);
|
|
|
|
g_source_attach(&iwp->parent, context);
|
|
g_source_unref(&iwp->parent);
|
|
return (GSource *)iwp;
|
|
}
|
|
|
|
static void io_remove_watch_poll(GSource *source)
|
|
{
|
|
IOWatchPoll *iwp;
|
|
|
|
iwp = io_watch_poll_from_source(source);
|
|
g_source_destroy(&iwp->parent);
|
|
}
|
|
|
|
void remove_fd_in_watch(Chardev *chr)
|
|
{
|
|
if (chr->gsource) {
|
|
io_remove_watch_poll(chr->gsource);
|
|
chr->gsource = NULL;
|
|
}
|
|
}
|
|
|
|
int io_channel_send_full(QIOChannel *ioc,
|
|
const void *buf, size_t len,
|
|
int *fds, size_t nfds)
|
|
{
|
|
size_t offset = 0;
|
|
|
|
while (offset < len) {
|
|
ssize_t ret = 0;
|
|
struct iovec iov = { .iov_base = (char *)buf + offset,
|
|
.iov_len = len - offset };
|
|
|
|
ret = qio_channel_writev_full(
|
|
ioc, &iov, 1,
|
|
fds, nfds, 0, NULL);
|
|
if (ret == QIO_CHANNEL_ERR_BLOCK) {
|
|
if (offset) {
|
|
return offset;
|
|
}
|
|
|
|
errno = EAGAIN;
|
|
return -1;
|
|
} else if (ret < 0) {
|
|
errno = EINVAL;
|
|
return -1;
|
|
}
|
|
|
|
offset += ret;
|
|
}
|
|
|
|
return offset;
|
|
}
|
|
|
|
int io_channel_send(QIOChannel *ioc, const void *buf, size_t len)
|
|
{
|
|
return io_channel_send_full(ioc, buf, len, NULL, 0);
|
|
}
|
|
|
|
void remove_listener_fd_in_watch(Chardev *chr)
|
|
{
|
|
ChardevClass *cc = CHARDEV_GET_CLASS(chr);
|
|
if (cc->chr_listener_cleanup) {
|
|
cc->chr_listener_cleanup(chr);
|
|
}
|
|
}
|