david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

aio-posix: avoid NULL pointer dereference in aio_epoll_update

Browse Source 
aio_epoll_update dereferences parameter "node", but it could have been NULL
if deleting an fd handler that was not registered in the first place.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20161108135524.25927-2-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Paolo Bonzini 2016-11-08 14:55:23 +01:00 committed by Stefan Hajnoczi
parent e6af1e0854
commit 36173ec5f1
1 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
aio-posix.c
View File

@ -217,21 +217,23 @@ void aio_set_fd_handler(AioContext *ctx,
/* Are we deleting the fd handler? */ /* Are we deleting the fd handler? */
if (!io_read && !io_write) { if (!io_read && !io_write) {
if (node) { if (node == NULL) {
g_source_remove_poll(&ctx->source, &node->pfd); return;
}
/* If the lock is held, just mark the node as deleted */ g_source_remove_poll(&ctx->source, &node->pfd);
if (ctx->walking_handlers) {
node->deleted = 1; /* If the lock is held, just mark the node as deleted */
node->pfd.revents = 0; if (ctx->walking_handlers) {
} else { node->deleted = 1;
/* Otherwise, delete it for real. We can't just mark it as node->pfd.revents = 0;
* deleted because deleted nodes are only cleaned up after } else {
* releasing the walking_handlers lock. /* Otherwise, delete it for real. We can't just mark it as
*/ * deleted because deleted nodes are only cleaned up after
QLIST_REMOVE(node, node); * releasing the walking_handlers lock.
deleted = true; */
} QLIST_REMOVE(node, node);
deleted = true;
} }
} else { } else {
if (node == NULL) { if (node == NULL) {