From patchwork Mon Jul 23 20:16:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 948003 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=linux.vnet.ibm.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="qHQlCJJZ"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41ZCv76r4fz9s1x for ; Tue, 24 Jul 2018 06:36:19 +1000 (AEST) Received: from localhost ([::1]:36428 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fhhZ3-0008Qk-IL for incoming@patchwork.ozlabs.org; Mon, 23 Jul 2018 16:36:17 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40993) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fhhIa-0001i5-75 for qemu-devel@nongnu.org; Mon, 23 Jul 2018 16:19:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fhhIZ-0002yw-6O for qemu-devel@nongnu.org; Mon, 23 Jul 2018 16:19:16 -0400 Received: from mail-oi0-x244.google.com ([2607:f8b0:4003:c06::244]:35582) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1fhhIZ-0002yM-1q; Mon, 23 Jul 2018 16:19:15 -0400 Received: by mail-oi0-x244.google.com with SMTP id i12-v6so3495656oik.2; Mon, 23 Jul 2018 13:19:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=vJNEMM5J7/Qf1SBLTqXhH7G0om3Wy3P6uvuPWDo0iPY=; b=qHQlCJJZuQoSJa3mF3dgQUMOZL6nKs3nqlxkkjJAQj56ufgWrJtQ44EfRG9+ZZeyWz cb9LmeLyIXSziudG/ikw5KTJcc3Aqs46m+9975F0cNR7iNwoWLVCuQvhm+nvIj4/J5u1 V3yjFPBWI6mIB5pJDy4a+T2pNLr/NNUqW8pj1PYW+45ojMZV+mPGS2J9plJgmr9AXRkG +ESMUr1oq3c5IUuBlalQ+udNNSbNb6bcnPj/cCyZvI7sUuQ+Ah4WLU3usC2Yhj1XNTRS d0m9IU9RyLIDITObPH6OA1V9e850rZbonooDNDOQuwWx6M7w20kBmPl9uK1+0xSfcMBq 2TRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=vJNEMM5J7/Qf1SBLTqXhH7G0om3Wy3P6uvuPWDo0iPY=; b=Wit8hb47V9kREQy9Fi3/Nr+Y48nrL4OR89T2hpYpIXA2P/LsXYDq3dq4n0MR234L4M CaAZ1Yy8wncSSzFyFfqcIrSITxq13P7/1NqjobfTyVPXwCj/kqalP02r4YuqZMJrgN+K 6+LzS4j1F4cUWyXMgbPKGlX5JyA5w71sfEdLv8CmPVy5Upx5hhpIKT/djTbmApenm/Yp aEKxlv4rF2yH8cSV6QjkCHP6w7OdtIJledPZ6wlDCBfzRbLCCeWwaZ0SE9f/IxWTb8WP addgN1vKIxpHgjH8gabnU7lRgKrbM14Jvzzd7qwRW8dw8LJ95tTn6gFBM9uhNzxXxT4y C5yw== X-Gm-Message-State: AOUpUlFciUYDGB9yPlSqj0RgTorkIMnZ+m0VffUH+pqETD43ujtR8GPS DtEv6D0yK0BQXPEocRhCgNA5ll5WWnU= X-Google-Smtp-Source: AAOMgpcKvTSSYEVRMJeMiwFanGuiAAvwrNNmldpOSYaZPw72H0v5PhIQ41OEIUPsPYyZPnDGxEy3uw== X-Received: by 2002:aca:f0a:: with SMTP id 10-v6mr303580oip.183.1532377153856; Mon, 23 Jul 2018 13:19:13 -0700 (PDT) Received: from localhost (76-251-165-188.lightspeed.austtx.sbcglobal.net. [76.251.165.188]) by smtp.gmail.com with ESMTPSA id m62-v6sm26381628oik.30.2018.07.23.13.19.12 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 23 Jul 2018 13:19:12 -0700 (PDT) From: Michael Roth To: qemu-devel@nongnu.org Date: Mon, 23 Jul 2018 15:16:32 -0500 Message-Id: <20180723201748.25573-24-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180723201748.25573-1-mdroth@linux.vnet.ibm.com> References: <20180723201748.25573-1-mdroth@linux.vnet.ibm.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4003:c06::244 Subject: [Qemu-devel] [PATCH 23/99] console: Avoid segfault in screendump X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michal Privoznik , qemu-stable@nongnu.org, Gerd Hoffmann Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Michal Privoznik After f771c5440e04626f1 it is possible to select device and head which to take screendump from. And even though we check if provided head number falls within range, it may still happen that the console has no surface yet leading to SIGSEGV: qemu.git $ ./x86_64-softmmu/qemu-system-x86_64 \ -qmp stdio \ -device virtio-vga,id=video0,max_outputs=4 {"execute":"qmp_capabilities"} {"execute":"screendump", "arguments":{"filename":"/tmp/screen.ppm", "device":"video0", "head":1}} Segmentation fault #0 0x00005628249dda88 in ppm_save (filename=0x56282826cbc0 "/tmp/screen.ppm", ds=0x0, errp=0x7fff52a6fae0) at ui/console.c:304 #1 0x00005628249ddd9b in qmp_screendump (filename=0x56282826cbc0 "/tmp/screen.ppm", has_device=true, device=0x5628276902d0 "video0", has_head=true, head=1, errp=0x7fff52a6fae0) at ui/console.c:375 #2 0x00005628247740df in qmp_marshal_screendump (args=0x562828265e00, ret=0x7fff52a6fb68, errp=0x7fff52a6fb60) at qapi/qapi-commands-ui.c:110 Here, @ds from frame #0 (or @surface from frame #1) is dereferenced at the very beginning of ppm_save(). And because it's NULL crash happens. Signed-off-by: Michal Privoznik Reviewed-by: Thomas Huth Message-id: cb05bb1909daa6ba62145c0194aafa05a14ed3d1.1526569138.git.mprivozn@redhat.com Signed-off-by: Gerd Hoffmann (cherry picked from commit 08d9864fa4e0c616e076ca8b225d39a7ecb189af) Signed-off-by: Michael Roth --- ui/console.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ui/console.c b/ui/console.c index 3fb2f4e09f..476bf901a4 100644 --- a/ui/console.c +++ b/ui/console.c @@ -370,6 +370,11 @@ void qmp_screendump(const char *filename, bool has_device, const char *device, graphic_hw_update(con); surface = qemu_console_surface(con); + if (!surface) { + error_setg(errp, "no surface"); + return; + } + ppm_save(filename, surface, errp); }