Skip to content
This repository has been archived by the owner on Nov 5, 2019. It is now read-only.

Commit

Permalink
msmouse: Fix segfault caused by free the chr before chardev cleanup.
Browse files Browse the repository at this point in the history 
Segfault happens when leaving qemu with msmouse backend:

 #0  0x00007fa8526ac975 in raise () at /lib64/libc.so.6
 #1  0x00007fa8526add8a in abort () at /lib64/libc.so.6
 #2  0x0000558be78846ab in error_exit (err=16, msg=0x558be799da10 ...
 #3  0x0000558be7884717 in qemu_mutex_destroy (mutex=0x558be93be750) at ...
 #4  0x0000558be7549951 in qemu_chr_free_common (chr=0x558be93be750) at ...
 #5  0x0000558be754999c in qemu_chr_free (chr=0x558be93be750) at ...
 #6  0x0000558be7549a20 in qemu_chr_delete (chr=0x558be93be750) at ...
 #7  0x0000558be754a8ef in qemu_chr_cleanup () at qemu-char.c:4643
 #8  0x0000558be755843e in main (argc=5, argv=0x7ffe925d7118, ...

The chr was freed by msmouse close callback before chardev cleanup,
Then qemu_mutex_destroy triggered raise().

Because freeing chr is handled by qemu_chr_free_common, Remove the free from
msmouse_chr_close to avoid double free.

Fixes: c1111a2
Cc: [email protected]
Signed-off-by: Lin Ma <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
  • Loading branch information
@morecache @bonzini
morecache authored and bonzini committed Sep 22, 2016
1 parent 95eaa78 commit 9e14037
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion backends/msmouse.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,6 @@ static void msmouse_chr_close (struct CharDriverState *chr)

qemu_input_handler_unregister(mouse->hs);
g_free(mouse);
g_free(chr);
}

static QemuInputHandler msmouse_handler = {
Expand Down

0 comments on commit 9e14037

Please sign in to comment.