From patchwork Mon Mar 10 12:49:06 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 328557 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id D6ACC2C00DE for ; Mon, 10 Mar 2014 23:50:14 +1100 (EST) Received: from localhost ([::1]:48524 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WMzem-0001JC-C4 for incoming@patchwork.ozlabs.org; Mon, 10 Mar 2014 08:50:12 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48050) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WMze9-0001Dv-CA for qemu-devel@nongnu.org; Mon, 10 Mar 2014 08:49:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WMze4-0000e8-Dp for qemu-devel@nongnu.org; Mon, 10 Mar 2014 08:49:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:25175) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WMze4-0000e4-4O for qemu-devel@nongnu.org; Mon, 10 Mar 2014 08:49:28 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s2ACnM0X002930 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 10 Mar 2014 08:49:22 -0400 Received: from nilsson.home.kraxel.org (vpn1-5-44.ams2.redhat.com [10.36.5.44]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s2ACnL6p001507; Mon, 10 Mar 2014 08:49:22 -0400 Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id 9DFA880BFE; Mon, 10 Mar 2014 13:49:20 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Mon, 10 Mar 2014 13:49:06 +0100 Message-Id: <1394455753-13783-3-git-send-email-kraxel@redhat.com> In-Reply-To: <1394455753-13783-1-git-send-email-kraxel@redhat.com> References: <1394455753-13783-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: "Gonglei \(Arei\)" , Gerd Hoffmann , Anthony Liguori Subject: [Qemu-devel] [PULL 2/9] vnc: Fix qemu crashed when vnc client disconnect suddenly X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: "Gonglei (Arei)" Hi, When I use RealVNC viewer client (http://www.realvnc.com/) to connect vnc server, the client disconnect suddenly, and I click reconnect button immediately, then the Qemu crashed. In the function vnc_worker_thread_loop, will call vnc_async_encoding_start to set the local vs->output buffer by global queue's buffer. Then send rectangles to the vnc client call function vnc_send_framebuffer_update. Finally, Under normal circumstances, call vnc_async_encoding_end to set the global queue'buffer by the local vs->output conversely. When the vnc client disconnect, the job->vs->csock will be set to -1. And the current prcoess logic will goto disconnected partion without call function vnc_async_encoding_end. But, the function vnc_send_framebuffer_update will call buffer_reserve, which maybe call g_realloc reset the local vs's buffer, meaning the global queue's buffer is modified also. If anyone use the original global queue's buffer memory will cause corruption and then crash qemu. This patch assure the function vnc_async_encoding_end being called even though the vnc client disconnect suddenly. Signed-off-by: Gonglei Signed-off-by: Gerd Hoffmann --- ui/vnc-jobs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c index 2d3fce8..a141f40 100644 --- a/ui/vnc-jobs.c +++ b/ui/vnc-jobs.c @@ -252,6 +252,8 @@ static int vnc_worker_thread_loop(VncJobQueue *queue) if (job->vs->csock == -1) { vnc_unlock_display(job->vs->vd); + /* Copy persistent encoding data */ + vnc_async_encoding_end(job->vs, &vs); goto disconnected; } @@ -278,6 +280,9 @@ static int vnc_worker_thread_loop(VncJobQueue *queue) vnc_async_encoding_end(job->vs, &vs); qemu_bh_schedule(job->vs->bh); + } else { + /* Copy persistent encoding data */ + vnc_async_encoding_end(job->vs, &vs); } vnc_unlock_output(job->vs);