diff options
| author | Uri Lublin <uril@redhat.com> | 2013-06-26 22:20:01 +0300 |
|---|---|---|
| committer | Uri Lublin <uril@redhat.com> | 2013-07-16 23:37:25 +0300 |
| commit | 255abf0a5726ed203937dce61ec570842c137708 (patch) | |
| tree | d354316bb11ebba59a9e13cf4bda16b5733d9385 | |
| parent | 53488f0275d6c8a121af49f7ac817d09ce68090d (diff) | |
| download | spice-255abf0a5726ed203937dce61ec570842c137708.tar.gz spice-255abf0a5726ed203937dce61ec570842c137708.tar.xz spice-255abf0a5726ed203937dce61ec570842c137708.zip | |
red_worker: use only RCC_FOREACH_SAFE
RCC_FOREACH may be dangerous
The following patches replace FOREACH loops with a SAFE version.
Using unsafe loops may cause spice-server to abort (assert fails).
Specifically a read/write fail in those loops, may cause the client
to disconnect, removing the node currently iterated, which cause spice
to abort in ring_next():
-- assertion `pos->next != NULL && pos->prev != NULL' failed
| -rw-r--r-- | server/red_worker.c | 11 |
1 files changed, 2 insertions, 9 deletions
diff --git a/server/red_worker.c b/server/red_worker.c index 825bca0f..a7f8d795 100644 --- a/server/red_worker.c +++ b/server/red_worker.c @@ -1113,13 +1113,6 @@ static inline uint64_t red_now(void); * given a channel, iterate over it's clients */ -#define RCC_FOREACH(link, rcc, channel) \ - for (link = ring_get_head(&(channel)->clients),\ - rcc = SPICE_CONTAINEROF(link, RedChannelClient, channel_link);\ - (link); \ - (link) = ring_next(&(channel)->clients, link),\ - rcc = SPICE_CONTAINEROF(link, RedChannelClient, channel_link)) - #define RCC_FOREACH_SAFE(link, next, rcc, channel) \ for (link = ring_get_head(&(channel)->clients), \ rcc = SPICE_CONTAINEROF(link, RedChannelClient, channel_link), \ @@ -1426,9 +1419,9 @@ static void red_push_surface_image(DisplayChannelClient *dcc, int surface_id); static void red_pipes_add_verb(RedChannel *channel, uint16_t verb) { RedChannelClient *rcc; - RingItem *link; + RingItem *link, *next; - RCC_FOREACH(link, rcc, channel) { + RCC_FOREACH_SAFE(link, next, rcc, channel) { red_pipe_add_verb(rcc, verb); } } |