From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Sun, 17 May 2009 16:38:39 +0000 (+0200)
Subject: Fix NULL alarm_timer pointer at exit
X-Git-Tag: v0.10.5~11
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe54857a130d8ce9e9f9b93b3e45e1d4c5ac9529;p=thirdparty%2Fqemu.git

Fix NULL alarm_timer pointer at exit

This fixes a SIGSEGV error on qemu exit.

Here is the valgrind output related to this error

==3648== Process terminating with default action of signal 11 (SIGSEGV)
==3648==  Access not within mapped region at address 0x8
==3648==    at 0x40636B: host_alarm_handler (vl.c:1345)
==3648==    by 0x52D807F: (within /lib/libpthread-2.9.so)
==3648==    by 0x5C0A12E: tcsetattr (in /lib/libc-2.9.so)
==3648==    by 0x4DD601: term_exit (qemu-char.c:700)
==3648==    by 0x5B636EC: exit (in /lib/libc-2.9.so)
==3648==    by 0x5B4B5AC: (below main) (in /lib/libc-2.9.so)

This simple fix check for a valid pointer as host_alarm_handler is
also called after alarm_timer is released in the exit path.

Signed-off-by: Jean-Christophe DUBOIS <jcd@tribudubois.net>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---

diff --git a/vl.c b/vl.c
index ca4255a86a8..efe29c93d29 100644
--- a/vl.c
+++ b/vl.c
@@ -894,7 +894,7 @@ struct qemu_alarm_timer {
 
 static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 {
-    return t->flags & ALARM_FLAG_DYNTICKS;
+    return t && (t->flags & ALARM_FLAG_DYNTICKS);
 }
 
 static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
@@ -1338,7 +1338,7 @@ static void host_alarm_handler(int host_signum)
         static const char byte = 0;
         write(alarm_timer_wfd, &byte, sizeof(byte));
 #endif
-        alarm_timer->flags |= ALARM_FLAG_EXPIRED;
+        if (alarm_timer) alarm_timer->flags |= ALARM_FLAG_EXPIRED;
 
         if (env) {
             /* stop the currently executing cpu because a timer occured */