diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2016-08-18 17:44:05 +0400 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2016-08-22 15:20:32 +0800 |
| commit | 67f3280c062d622dc077246b483702096d11dcc0 (patch) | |
| tree | 7e05557c7ebd590a628e40e9b506d9a6665f66a7 /net | |
| parent | 5f9f818ea88a013b2464563be354dd2f0f316407 (diff) | |
| download | qemu-67f3280c062d622dc077246b483702096d11dcc0.zip qemu-67f3280c062d622dc077246b483702096d11dcc0.tar.gz qemu-67f3280c062d622dc077246b483702096d11dcc0.tar.bz2 | |
slirp: fix segv when init failed
Since commit f6c2e66ae8c8a, slirp uses an exit notifier to call
slirp_smb_cleanup. However, if init() failed, the notifier isn't added,
and removing it will fail:
==18447== Invalid write of size 8
==18447== at 0x7EF2B5: notifier_remove (notify.c:32)
==18447== by 0x48E80C: qemu_remove_exit_notifier (vl.c:2661)
==18447== by 0x6A2187: net_slirp_cleanup (slirp.c:134)
==18447== by 0x69419D: qemu_cleanup_net_client (net.c:338)
==18447== by 0x69445B: qemu_del_net_client (net.c:401)
==18447== by 0x6A2B81: net_slirp_init (slirp.c:366)
==18447== by 0x6A4241: net_init_slirp (slirp.c:865)
==18447== by 0x695C6D: net_client_init1 (net.c:1051)
==18447== by 0x695F6E: net_client_init (net.c:1108)
==18447== by 0x696DBA: net_init_netdev (net.c:1498)
==18447== by 0x7F1F99: qemu_opts_foreach (qemu-option.c:1116)
==18447== by 0x696E60: net_init_clients (net.c:1516)
==18447== Address 0x0 is not stack'd, malloc'd or (recently) free'd
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/slirp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/slirp.c b/net/slirp.c index facc30e..b60893f 100644 --- a/net/slirp.c +++ b/net/slirp.c @@ -131,7 +131,9 @@ static void net_slirp_cleanup(NetClientState *nc) SlirpState *s = DO_UPCAST(SlirpState, nc, nc); slirp_cleanup(s->slirp); - qemu_remove_exit_notifier(&s->exit_notifier); + if (s->exit_notifier.notify) { + qemu_remove_exit_notifier(&s->exit_notifier); + } slirp_smb_cleanup(s); QTAILQ_REMOVE(&slirp_stacks, s, entry); } |