[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] msmouse: Fix segfault caused by free the chr before
From: |
Lin Ma |
Subject: |
[Qemu-devel] [PATCH] msmouse: Fix segfault caused by free the chr before chardev cleanup. |
Date: |
Thu, 15 Sep 2016 22:31:58 +0800 |
Segfault happens when leaving qemu with msmouse backend:
#0 0x00007fa8526ac975 in raise () at /lib64/libc.so.6
#1 0x00007fa8526add8a in abort () at /lib64/libc.so.6
#2 0x0000558be78846ab in error_exit (err=16, msg=0x558be799da10 ...
#3 0x0000558be7884717 in qemu_mutex_destroy (mutex=0x558be93be750) at ...
#4 0x0000558be7549951 in qemu_chr_free_common (chr=0x558be93be750) at ...
#5 0x0000558be754999c in qemu_chr_free (chr=0x558be93be750) at ...
#6 0x0000558be7549a20 in qemu_chr_delete (chr=0x558be93be750) at ...
#7 0x0000558be754a8ef in qemu_chr_cleanup () at qemu-char.c:4643
#8 0x0000558be755843e in main (argc=5, argv=0x7ffe925d7118, ...
The chr was freed by msmouse close callback before chardev cleanup,
Then qemu_mutex_destroy triggered raise().
Because freeing chr is handled by qemu_chr_free_common, Remove the free from
msmouse_chr_close to avoid double free.
Signed-off-by: Lin Ma <address@hidden>
---
backends/msmouse.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/backends/msmouse.c b/backends/msmouse.c
index aeb9055..7690c42 100644
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -139,7 +139,6 @@ static void msmouse_chr_close (struct CharDriverState *chr)
qemu_input_handler_unregister(mouse->hs);
g_free(mouse);
- g_free(chr);
}
static QemuInputHandler msmouse_handler = {
--
2.9.2
- [Qemu-devel] [PATCH] msmouse: Fix segfault caused by free the chr before chardev cleanup.,
Lin Ma <=