From 6f1de6b70d857d5e316ae6fd908f52818b827b08 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Mon, 20 Jun 2016 15:02:40 +0200 Subject: char: change qemu_chr_fe_add_watch to return unsigned g_source_attach can return any value between 1 and UINT_MAX if you let QEMU run long enough. However, qemu_chr_fe_add_watch can also return a negative errno value when the device is disconnected or does not support chr_add_watch. Change it to return zero to avoid overloading these values. Fix the cadence_uart which asserts in this case (easily obtained with "-serial pty"). Tested-by: Bret Ketchum Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Paolo Bonzini --- net/vhost-user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/vhost-user.c b/net/vhost-user.c index d72ce9b490..636899a877 100644 --- a/net/vhost-user.c +++ b/net/vhost-user.c @@ -22,7 +22,7 @@ typedef struct VhostUserState { NetClientState nc; CharDriverState *chr; VHostNetState *vhost_net; - int watch; + guint watch; uint64_t acked_features; } VhostUserState; -- cgit v1.2.1 From 25f0d2aa5e3d21caa1bc622b21368cc2e383f02c Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 29 Jun 2016 15:15:33 +0200 Subject: vhost-user: disable chardev handlers on close MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This otherwise causes a use-after-free if network backend cleanup is performed before character device cleanup. Cc: Marc-André Lureau Signed-off-by: Paolo Bonzini --- net/vhost-user.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'net') diff --git a/net/vhost-user.c b/net/vhost-user.c index 636899a877..92f4cfd1b1 100644 --- a/net/vhost-user.c +++ b/net/vhost-user.c @@ -151,6 +151,11 @@ static void vhost_user_cleanup(NetClientState *nc) vhost_net_cleanup(s->vhost_net); s->vhost_net = NULL; } + if (s->chr) { + qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL); + qemu_chr_fe_release(s->chr); + s->chr = NULL; + } qemu_purge_queued_packets(nc); } -- cgit v1.2.1