motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-06 01:03:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

qdev: Use GList for global properties

Browse source 
If the same GlobalProperty struct is registered twice, the list
entry gets corrupted, making tqe_next points to itself, and
qdev_prop_set_globals() gets stuck in a loop. The bug can be
easily reproduced by running:

  $ qemu-system-x86_64 -rtc-td-hack -rtc-td-hack

Change global_props to use GList instead of queue.h, making the
code simpler and able to deal with properties being registered
twice.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
This commit is contained in:
Eduardo Habkost 2016-01-28 12:22:35 -02:00
parent 4acc8fdfd3
commit f9a8b5530d
2 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hw/core/qdev-properties.c
View file

@ -1020,12 +1020,11 @@ void qdev_prop_set_ptr(DeviceState *dev, const char *name, void *value)
*ptr = value;
}
static QTAILQ_HEAD(, GlobalProperty) global_props =
QTAILQ_HEAD_INITIALIZER(global_props);
static GList *global_props;
void qdev_prop_register_global(GlobalProperty *prop)
{
QTAILQ_INSERT_TAIL(&global_props, prop, next);
global_props = g_list_append(global_props, prop);
}
void qdev_prop_register_global_list(GlobalProperty *props)
@ -1039,10 +1038,11 @@ void qdev_prop_register_global_list(GlobalProperty *props)
int qdev_prop_check_globals(void)
{
GlobalProperty *prop;
GList *l;
int ret = 0;
QTAILQ_FOREACH(prop, &global_props, next) {
for (l = global_props; l; l = l->next) {
GlobalProperty *prop = l->data;
ObjectClass *oc;
DeviceClass *dc;
if (prop->used) {
@ -1073,9 +1073,10 @@ int qdev_prop_check_globals(void)
static void qdev_prop_set_globals_for_type(DeviceState *dev,
const char *typename)
{
GlobalProperty *prop;
GList *l;
QTAILQ_FOREACH(prop, &global_props, next) {
for (l = global_props; l; l = l->next) {
GlobalProperty *prop = l->data;
Error *err = NULL;
if (strcmp(typename, prop->driver) != 0) {