[for-2.7,v3,19/36] char: free the tcp connection data when closing

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Make sure the connection data got freed when closing the chardev, to
avoid leaks.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 qemu-char.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

On 03/08/2016 16:55, marcandre.lureau@redhat.com wrote:
> @@ -2851,11 +2851,6 @@ static void tcp_chr_disconnect(CharDriverState *chr)
>          return;
>      }
>  
> -    s->connected = 0;
> -    if (s->listen_ioc) {
> -        s->listen_tag = qio_channel_add_watch(
> -            QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NULL);
> -    }
>      tcp_set_msgfds(chr, NULL, 0);
>      remove_fd_in_watch(chr);
>      object_unref(OBJECT(s->sioc));
> @@ -2863,6 +2858,24 @@ static void tcp_chr_disconnect(CharDriverState *chr)
>      object_unref(OBJECT(s->ioc));
>      s->ioc = NULL;
>      g_free(chr->filename);
> +    chr->filename = NULL;
> +    s->connected = 0;
> +}
> +
> +static void tcp_chr_disconnect(CharDriverState *chr)
> +{
> +    TCPCharDriver *s = chr->opaque;
> +
> +    if (!s->connected) {
> +        return;
> +    }
> +
> +    tcp_chr_free_connection(chr);
> +
> +    if (s->listen_ioc) {
> +        s->listen_tag = qio_channel_add_watch(
> +            QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NULL);
> +    }

I think

    if (s->read_msgfds_num) {
        for (i = 0; i < s->read_msgfds_num; i++) {
            close(s->read_msgfds[i]);
        }
        g_free(s->read_msgfds);
    }


should be moved from tcp_chr_close to tcp_chr_free_connection.  The
following parts of tcp_chr_close instead are now duplicate, and can be
removed:

    remove_fd_in_watch(chr);
    if (s->ioc) {
        object_unref(OBJECT(s->ioc));
    }
    if (s->write_msgfds_num) {
        g_free(s->write_msgfds);
    }

are now duplicate and can be removed.

Finally, since you're at it, here in tcp_set_msgfds:

    /* clear old pending fd array */
    g_free(s->write_msgfds);
    s->write_msgfds = NULL;

it's best to add a s->write_msgfds_num = 0.

Thanks,

Paolo

Hi

----- Original Message -----
> 
> 
> On 03/08/2016 16:55, marcandre.lureau@redhat.com wrote:
> > @@ -2851,11 +2851,6 @@ static void tcp_chr_disconnect(CharDriverState *chr)
> >          return;
> >      }
> >  
> > -    s->connected = 0;
> > -    if (s->listen_ioc) {
> > -        s->listen_tag = qio_channel_add_watch(
> > -            QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr,
> > NULL);
> > -    }
> >      tcp_set_msgfds(chr, NULL, 0);
> >      remove_fd_in_watch(chr);
> >      object_unref(OBJECT(s->sioc));
> > @@ -2863,6 +2858,24 @@ static void tcp_chr_disconnect(CharDriverState *chr)
> >      object_unref(OBJECT(s->ioc));
> >      s->ioc = NULL;
> >      g_free(chr->filename);
> > +    chr->filename = NULL;
> > +    s->connected = 0;
> > +}
> > +
> > +static void tcp_chr_disconnect(CharDriverState *chr)
> > +{
> > +    TCPCharDriver *s = chr->opaque;
> > +
> > +    if (!s->connected) {
> > +        return;
> > +    }
> > +
> > +    tcp_chr_free_connection(chr);
> > +
> > +    if (s->listen_ioc) {
> > +        s->listen_tag = qio_channel_add_watch(
> > +            QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr,
> > NULL);
> > +    }
> 
> I think
> 
>     if (s->read_msgfds_num) {
>         for (i = 0; i < s->read_msgfds_num; i++) {
>             close(s->read_msgfds[i]);
>         }
>         g_free(s->read_msgfds);
>     }
> 
> 
> should be moved from tcp_chr_close to tcp_chr_free_connection.  The
> following parts of tcp_chr_close instead are now duplicate, and can be
> removed:
> 
>     remove_fd_in_watch(chr);
>     if (s->ioc) {
>         object_unref(OBJECT(s->ioc));
>     }
>     if (s->write_msgfds_num) {
>         g_free(s->write_msgfds);
>     }
> 
> are now duplicate and can be removed.

correct

> 
> Finally, since you're at it, here in tcp_set_msgfds:
> 
>     /* clear old pending fd array */
>     g_free(s->write_msgfds);
>     s->write_msgfds = NULL;
> 
> it's best to add a s->write_msgfds_num = 0.

That makes sense, for the error case.

done