[Spice-devel] [spice-gtk v1 2/2] channel-usbredir: Fix crash on channel-up

[Victor Toso]

Hi,

On Tue, Apr 10, 2018 at 12:41:16PM +0200, Christophe Fergeau wrote:
> On Fri, Apr 06, 2018 at 09:59:44AM +0200, Victor Toso wrote:
> > From: Victor Toso <me at victortoso.com>
> > 
> > By adding a guard to not handle channel-up on SpiceUsbredirChannel in
> > case struct usbredirhost wasn't initialized yet. Same guard is in
> > place for the generic usbredir_handle_msg() function to avoid handling
> > Server's message while Client's initialization is not done.
> > 
> > As mentioned in commit 291f3e4419e6, this isn't a problem for
> > graphical clients as some initialization is done to present the
> > shareable usb devices to user.
> > 
> > Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1399838
> > ---
> >  src/channel-usbredir.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/src/channel-usbredir.c b/src/channel-usbredir.c
> > index f509e49..6df3b61 100644
> > --- a/src/channel-usbredir.c
> > +++ b/src/channel-usbredir.c
> > @@ -819,6 +819,7 @@ static void spice_usbredir_channel_up(SpiceChannel *c)
> >      SpiceUsbredirChannel *channel = SPICE_USBREDIR_CHANNEL(c);
> >      SpiceUsbredirChannelPrivate *priv = channel->priv;
> >  
> > +    g_return_if_fail(priv->host != NULL);
> 
> If this triggers, does this indicates an issue with spice-gtk
> code that we need to fix? Or do we just want to ignore
> spice_usbredir_channel_up() if host in not set yet?

IMHO, for UI clients like remote-viewer or gnome-boxes, this
critical is a problem that needs to be fixed. Same should go on
migration. But I haven't seen this been triggered and that's
because spice-gtk already calls spice_usb_device_manager_get() in
other places.

For non UI tools like spicy-stats, this can be fixed by calling
spice_usb_device_manager_get() or disabling usbredir.

Considering that it is possible to have a connection between
spice-server and spice-gtk where priv->host is not set, this
guard makes sense.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20180410/a4f1749c/attachment.sig>