char_device: Don't set active when stopped and don't access dev after unref

2 closely related changes in one:
1) When leaving the read or write loop because the chardev has been stopped
active should not be updated. It has been set to FALSE by
spice_char_device_stop and should stay FALSE
2) The updating of dev->active should be done *before* unref-ing dev

Signed-off-by: Hans de Goede <hdegoede@redhat.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/server/char_device.c b/server/char_device.c
index 63afee11..f500f04f 100644
--- a/server/char_device.c
+++ b/server/char_device.c
@@ -320,8 +320,10 @@ static int spice_char_device_read_from_device(SpiceCharDeviceState *dev)
         max_send_tokens--;
     }
     dev->during_read_from_device = 0;
+    if (dev->running) {
+        dev->active = dev->active || did_read;
+    }
     spice_char_device_state_unref(dev);
-    dev->active = dev->active || did_read;
     return did_read;
 }
 
@@ -475,9 +477,9 @@ static int spice_char_device_write_to_device(SpiceCharDeviceState *dev)
         } else {
             spice_assert(ring_is_empty(&dev->write_queue));
         }
+        dev->active = dev->active || total;
     }
     spice_char_device_state_unref(dev);
-    dev->active = dev->active || total;
     return total;
 }