diff options
author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2021-07-23 13:54:54 +0400 |
---|---|---|
committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2021-08-05 16:15:33 +0400 |
commit | 46fe3ff6ea3e7a642b8545c0322ef5df873bd560 (patch) | |
tree | 11fd82d6cd1325fd941c75d2f3db5e1beaa1b6a7 /chardev | |
parent | bb2b058f1a4e4fe9031133f2f7876fb12b2104d7 (diff) | |
download | qemu-46fe3ff6ea3e7a642b8545c0322ef5df873bd560.zip qemu-46fe3ff6ea3e7a642b8545c0322ef5df873bd560.tar.gz qemu-46fe3ff6ea3e7a642b8545c0322ef5df873bd560.tar.bz2 |
chardev: fix qemu_chr_open_fd() being called with fd=-1
The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may
cause invalid system calls, as the QIOChannel is assumed to be properly
initialized later on.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'chardev')
-rw-r--r-- | chardev/char-fd.c | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/chardev/char-fd.c b/chardev/char-fd.c index 743d398..c11b103 100644 --- a/chardev/char-fd.c +++ b/chardev/char-fd.c @@ -39,6 +39,10 @@ static int fd_chr_write(Chardev *chr, const uint8_t *buf, int len) { FDChardev *s = FD_CHARDEV(chr); + if (!s->ioc_out) { + return -1; + } + return io_channel_send(s->ioc_out, buf, len); } @@ -209,15 +213,19 @@ void qemu_chr_open_fd(Chardev *chr, FDChardev *s = FD_CHARDEV(chr); char *name; - s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in)); - name = g_strdup_printf("chardev-file-in-%s", chr->label); - qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name); - g_free(name); - s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out)); - name = g_strdup_printf("chardev-file-out-%s", chr->label); - qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name); - g_free(name); - qemu_set_nonblock(fd_out); + if (fd_in >= 0) { + s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in)); + name = g_strdup_printf("chardev-file-in-%s", chr->label); + qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name); + g_free(name); + } + if (fd_out >= 0) { + s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out)); + name = g_strdup_printf("chardev-file-out-%s", chr->label); + qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name); + g_free(name); + qemu_set_nonblock(fd_out); + } } static void char_fd_class_init(ObjectClass *oc, void *data) |