input: free InputEvent when it can't be inserted into a full kdb queue

Message ID CABkJTM4RL4cZ0euYX7d8xPd7ozrN76nr0rafut0LBJmZWFD+Vw@mail.gmail.com
State New
Headers show
Series
  • input: free InputEvent when it can't be inserted into a full kdb queue
Related show

Commit Message

Tian Dianchen Dec. 6, 2017, 2:29 a.m.
From e8c03f405c2112428e79bb82064c7b7743d0cc86 Mon Sep 17 00:00:00 2001
From: Tian Dianchen <dianchen.tdc@gmail.com>
Date: Tue, 5 Dec 2017 14:03:53 +0800
Subject: [PATCH] input: free InputEvent when it can't be inserted into a
full
 kdb queue

When the kdb queue is full, the evt can't be placed in it, so it should
be released to free the memory.

Impact: Without this limit vnc clients can exhaust host memory by keep
sending keyboard events when kdb queue is full.

Reviewed-by: Zhang Chao <icymemo@gmail.com>
Reviewed-by: Quan Xu <quan.xu0@gmail.com>
Signed-off-by: Tian Dianchen <dianchen.tdc@gmail.com>
---
 ui/input.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Marc-André Lureau Dec. 6, 2017, 9:46 a.m. | #1
Hi

On Wed, Dec 6, 2017 at 3:29 AM, 田殿臣 <dianchen.tdc@gmail.com> wrote:
> From e8c03f405c2112428e79bb82064c7b7743d0cc86 Mon Sep 17 00:00:00 2001
> From: Tian Dianchen <dianchen.tdc@gmail.com>
> Date: Tue, 5 Dec 2017 14:03:53 +0800
> Subject: [PATCH] input: free InputEvent when it can't be inserted into a
> full
>  kdb queue
>
> When the kdb queue is full, the evt can't be placed in it, so it should
> be released to free the memory.
>
> Impact: Without this limit vnc clients can exhaust host memory by keep
> sending keyboard events when kdb queue is full.

You may add "Leak introduced in commit fa18f36a461984eae50ab957e47ec78dae3c14fc"

>
> Reviewed-by: Zhang Chao <icymemo@gmail.com>
> Reviewed-by: Quan Xu <quan.xu0@gmail.com>
> Signed-off-by: Tian Dianchen <dianchen.tdc@gmail.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>


> ---
>  ui/input.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/ui/input.c b/ui/input.c
> index 3e2d324..e5b78aa 100644
> --- a/ui/input.c
> +++ b/ui/input.c
> @@ -421,6 +421,8 @@ void qemu_input_event_send_key(QemuConsole *src,
> KeyValue *key, bool down)
>      } else if (queue_count < queue_limit) {
>          qemu_input_queue_event(&kbd_queue, src, evt);
>          qemu_input_queue_sync(&kbd_queue);
> +    } else {
> +        qapi_free_InputEvent(evt);
>      }
>  }
>
> --
> 1.8.3.1
Tian Dianchen Dec. 7, 2017, 2:38 a.m. | #2
Hi, Marc-André Lureau
Thank you for your comments.

Hi,Gerd Hoffmann,
If there is no other comments,please join this note when merge this patch .


2017-12-06 17:46 GMT+08:00 Marc-André Lureau <marcandre.lureau@gmail.com>:

> Hi
>
> On Wed, Dec 6, 2017 at 3:29 AM, 田殿臣 <dianchen.tdc@gmail.com> wrote:
> > From e8c03f405c2112428e79bb82064c7b7743d0cc86 Mon Sep 17 00:00:00 2001
> > From: Tian Dianchen <dianchen.tdc@gmail.com>
> > Date: Tue, 5 Dec 2017 14:03:53 +0800
> > Subject: [PATCH] input: free InputEvent when it can't be inserted into a
> > full
> >  kdb queue
> >
> > When the kdb queue is full, the evt can't be placed in it, so it should
> > be released to free the memory.
> >
> > Impact: Without this limit vnc clients can exhaust host memory by keep
> > sending keyboard events when kdb queue is full.
>
> You may add "Leak introduced in commit fa18f36a461984eae50ab957e47ec7
> 8dae3c14fc"
>
> >
> > Reviewed-by: Zhang Chao <icymemo@gmail.com>
> > Reviewed-by: Quan Xu <quan.xu0@gmail.com>
> > Signed-off-by: Tian Dianchen <dianchen.tdc@gmail.com>
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>
>
> > ---
> >  ui/input.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/ui/input.c b/ui/input.c
> > index 3e2d324..e5b78aa 100644
> > --- a/ui/input.c
> > +++ b/ui/input.c
> > @@ -421,6 +421,8 @@ void qemu_input_event_send_key(QemuConsole *src,
> > KeyValue *key, bool down)
> >      } else if (queue_count < queue_limit) {
> >          qemu_input_queue_event(&kbd_queue, src, evt);
> >          qemu_input_queue_sync(&kbd_queue);
> > +    } else {
> > +        qapi_free_InputEvent(evt);
> >      }
> >  }
> >
> > --
> > 1.8.3.1
>
>
>
> --
> Marc-André Lureau
>

Patch

diff --git a/ui/input.c b/ui/input.c
index 3e2d324..e5b78aa 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -421,6 +421,8 @@  void qemu_input_event_send_key(QemuConsole *src,
KeyValue *key, bool down)
     } else if (queue_count < queue_limit) {
         qemu_input_queue_event(&kbd_queue, src, evt);
         qemu_input_queue_sync(&kbd_queue);
+    } else {
+        qapi_free_InputEvent(evt);
     }
 }