[Qemu-devel] [PATCH] virtio-serial: Fix segfault on guest boot

[Luiz Capitulino]

If I start qemu with:

 # qemu -hda disks/test.img -enable-kvm -m 1G -snapshot \
        -device virtio-serial \
        -chardev socket,host=localhost,port=1234,server,nowait,id=foo \
        -device virtserialport,chardev=foo,name=org.qemu.guest_agent

I get a segfault when booting a Fedora 14 guest. The backtrace says:

  Program terminated with signal 11, Segmentation fault.
  #0  0x0000000000420850 in handle_control_message (vser=0x3732bd0, 
buf=0x2c173e0, len=8) at 
/home/lcapitulino/src/qmp-unstable/hw/virtio-serial-bus.c:335
  335     info = DO_UPCAST(VirtIOSerialPortInfo, qdev, port->dev.info);

I've also bisected this and git points out to commit:

  commit a15bb0d6a981de749452a5180fc8084d625671da
  Author: Markus Armbruster <address@hidden>
  Date:   Wed May 25 14:21:13 2011 +0200

      virtio-serial: Drop redundant VirtIOSerialPort member info

I think what's happening is that the device is not initialized on a
VIRTIO_CONSOLE_DEVICE_READY event. Moving the DO_UPCAST() call to
the other events fixes the problem to me.

Signed-off-by: Luiz Capitulino <address@hidden>
---
 hw/virtio-serial-bus.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 9a12104..579f676 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -332,8 +332,6 @@ static void handle_control_message(VirtIOSerial *vser, void 
*buf, size_t len)
     if (!port && cpkt.event != VIRTIO_CONSOLE_DEVICE_READY)
         return;
 
-    info = DO_UPCAST(VirtIOSerialPortInfo, qdev, port->dev.info);
-
     switch(cpkt.event) {
     case VIRTIO_CONSOLE_DEVICE_READY:
         if (!cpkt.value) {
@@ -363,6 +361,7 @@ static void handle_control_message(VirtIOSerial *vser, void 
*buf, size_t len)
          * this port is a console port so that the guest can hook it
          * up to hvc.
          */
+        info = DO_UPCAST(VirtIOSerialPortInfo, qdev, port->dev.info);
         if (info->is_console) {
             send_control_event(port, VIRTIO_CONSOLE_CONSOLE_PORT, 1);
         }
@@ -398,6 +397,7 @@ static void handle_control_message(VirtIOSerial *vser, void 
*buf, size_t len)
         break;
 
     case VIRTIO_CONSOLE_PORT_OPEN:
+        info = DO_UPCAST(VirtIOSerialPortInfo, qdev, port->dev.info);
         port->guest_connected = cpkt.value;
         if (cpkt.value && info->guest_open) {
             /* Send the guest opened notification if an app is interested */
-- 
1.7.4.4