On Fri, Jul 23, 2021 at 02:28:22PM +0400, marcandre.lur...@redhat.com wrote: > From: Marc-André Lureau <marcandre.lur...@redhat.com> > > The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may > cause invalid system calls, as the QIOChannel is assumed to be properly > initialized later on. > > Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com> > --- > chardev/char-fd.c | 22 +++++++++++++--------- > 1 file changed, 13 insertions(+), 9 deletions(-) > > diff --git a/chardev/char-fd.c b/chardev/char-fd.c > index 1cd62f2779..ee85a52c06 100644 > --- a/chardev/char-fd.c > +++ b/chardev/char-fd.c > @@ -133,15 +133,19 @@ void qemu_chr_open_fd(Chardev *chr, > FDChardev *s = FD_CHARDEV(chr); > char *name; > > - s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in)); > - name = g_strdup_printf("chardev-file-in-%s", chr->label); > - qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name); > - g_free(name); > - s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out)); > - name = g_strdup_printf("chardev-file-out-%s", chr->label); > - qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name); > - g_free(name); > - qemu_set_nonblock(fd_out); > + if (fd_in >= 0) { > + s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in)); > + name = g_strdup_printf("chardev-file-in-%s", chr->label); > + qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name); > + g_free(name); > + } > + if (fd_out >= 0) { > + s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out)); > + name = g_strdup_printf("chardev-file-out-%s", chr->label); > + qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name); > + g_free(name); > + qemu_set_nonblock(fd_out); > + }
Other code in this file assumes ioc_out is non-NULL, so this looks like an incomplete fix. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|