On 3/18/19 5:08 AM, Nikolay Shirokovskiy wrote:
> On error in main thread virConsoleShutdown is called which
> deletes fd watches/stream callback and yet callbacks can
> be called after. Thus we can incorrectly allocate
> terminalToStream.data memory and get memory leak for example.
> Let's check if console was shutdown in the very beginning of
> callbacks.
>
> Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@xxxxxxxxxxxxx>
> ---
> tools/virsh-console.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/tools/virsh-console.c b/tools/virsh-console.c
> index 3dae707..d109734 100644
> --- a/tools/virsh-console.c
> +++ b/tools/virsh-console.c
> @@ -139,6 +139,10 @@ virConsoleEventOnStream(virStreamPtr st,
>
> virObjectLock(con);
>
> + /* we got late event after console was shutdown */
> + if (!con->st)
> + goto cleanup;
> +
> if (events & VIR_STREAM_EVENT_READABLE) {
> size_t avail = con->streamToTerminal.length -
> con->streamToTerminal.offset;
> @@ -219,6 +223,10 @@ virConsoleEventOnStdin(int watch ATTRIBUTE_UNUSED,
>
> virObjectLock(con);
>
> + /* we got late event after console was shutdown */
> + if (!con->st)
> + goto cleanup;
> +
> if (events & VIR_EVENT_HANDLE_READABLE) {
> size_t avail = con->terminalToStream.length -
> con->terminalToStream.offset;
> @@ -279,6 +287,10 @@ virConsoleEventOnStdout(int watch ATTRIBUTE_UNUSED,
>
> virObjectLock(con);
>
> + /* we got late event after console was shutdown */
> + if (!con->st)
> + goto cleanup;
> +
> if (events & VIR_EVENT_HANDLE_WRITABLE &&
> con->streamToTerminal.offset) {
> ssize_t done;
>
I didn't verify exactly how this case can happen but it seems sane, so:
Reviewed-by: Cole Robinson <crobinso@xxxxxxxxxx>
- Cole
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list
