aboutsummaryrefslogtreecommitdiff
path: root/backends
diff options
context:
space:
mode:
authorLin Ma <lma@suse.com>2016-09-15 22:31:58 +0800
committerPaolo Bonzini <pbonzini@redhat.com>2016-09-22 20:20:53 +0200
commit9e14037f05e99ca3b8a33d8be9a2a636bbf09326 (patch)
treecc370c0f4bd2e33a157672a4076608ba1a156b42 /backends
parent95eaa78537c734fa3cb3373d47ba8c0099a36ff0 (diff)
downloadqemu-arm-9e14037f05e99ca3b8a33d8be9a2a636bbf09326.tar.gz
msmouse: Fix segfault caused by free the chr before chardev cleanup.
Segfault happens when leaving qemu with msmouse backend: #0 0x00007fa8526ac975 in raise () at /lib64/libc.so.6 #1 0x00007fa8526add8a in abort () at /lib64/libc.so.6 #2 0x0000558be78846ab in error_exit (err=16, msg=0x558be799da10 ... #3 0x0000558be7884717 in qemu_mutex_destroy (mutex=0x558be93be750) at ... #4 0x0000558be7549951 in qemu_chr_free_common (chr=0x558be93be750) at ... #5 0x0000558be754999c in qemu_chr_free (chr=0x558be93be750) at ... #6 0x0000558be7549a20 in qemu_chr_delete (chr=0x558be93be750) at ... #7 0x0000558be754a8ef in qemu_chr_cleanup () at qemu-char.c:4643 #8 0x0000558be755843e in main (argc=5, argv=0x7ffe925d7118, ... The chr was freed by msmouse close callback before chardev cleanup, Then qemu_mutex_destroy triggered raise(). Because freeing chr is handled by qemu_chr_free_common, Remove the free from msmouse_chr_close to avoid double free. Fixes: c1111a24a3358ecd2f17be7c8b117cfe8bc5e5f8 Cc: qemu-stable@nongnu.org Signed-off-by: Lin Ma <lma@suse.com> Message-Id: <20160915143158.4796-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'backends')
-rw-r--r--backends/msmouse.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/backends/msmouse.c b/backends/msmouse.c
index aceb6dc475..85d08f753e 100644
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -139,7 +139,6 @@ static void msmouse_chr_close (struct CharDriverState *chr)
qemu_input_handler_unregister(mouse->hs);
g_free(mouse);
- g_free(chr);
}
static QemuInputHandler msmouse_handler = {