[Spice-devel] [spice-gtk v1 2/2] channel-usbredir: Fix crash on channel-up

[Victor Toso]

On Tue, Apr 10, 2018 at 05:19:05PM +0200, Christophe Fergeau wrote:
> On Tue, Apr 10, 2018 at 02:17:45PM +0200, Victor Toso wrote:
> > Hi,
> > 
> > On Tue, Apr 10, 2018 at 01:37:05PM +0200, Victor Toso wrote:
> > > Hi,
> > > 
> > > On Tue, Apr 10, 2018 at 12:41:16PM +0200, Christophe Fergeau wrote:
> > > > On Fri, Apr 06, 2018 at 09:59:44AM +0200, Victor Toso wrote:
> > > > > From: Victor Toso <me at victortoso.com>
> > > > > 
> > > > > By adding a guard to not handle channel-up on SpiceUsbredirChannel in
> > > > > case struct usbredirhost wasn't initialized yet. Same guard is in
> > > > > place for the generic usbredir_handle_msg() function to avoid handling
> > > > > Server's message while Client's initialization is not done.
> > > > > 
> > > > > As mentioned in commit 291f3e4419e6, this isn't a problem for
> > > > > graphical clients as some initialization is done to present the
> > > > > shareable usb devices to user.
> > > > > 
> > > > > Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1399838
> > > > > ---
> > > > >  src/channel-usbredir.c | 1 +
> > > > >  1 file changed, 1 insertion(+)
> > > > > 
> > > > > diff --git a/src/channel-usbredir.c b/src/channel-usbredir.c
> > > > > index f509e49..6df3b61 100644
> > > > > --- a/src/channel-usbredir.c
> > > > > +++ b/src/channel-usbredir.c
> > > > > @@ -819,6 +819,7 @@ static void spice_usbredir_channel_up(SpiceChannel *c)
> > > > >      SpiceUsbredirChannel *channel = SPICE_USBREDIR_CHANNEL(c);
> > > > >      SpiceUsbredirChannelPrivate *priv = channel->priv;
> > > > >  
> > > > > +    g_return_if_fail(priv->host != NULL);
> > > > 
> > > > If this triggers, does this indicates an issue with spice-gtk
> > > > code that we need to fix? Or do we just want to ignore
> > > > spice_usbredir_channel_up() if host in not set yet?
> > > 
> > > IMHO, for UI clients like remote-viewer or gnome-boxes, this
> > > critical is a problem that needs to be fixed. Same should go on
> > > migration. But I haven't seen this been triggered and that's
> > > because spice-gtk already calls spice_usb_device_manager_get() in
> > > other places.
> > > 
> > > For non UI tools like spicy-stats, this can be fixed by calling
> > > spice_usb_device_manager_get() or disabling usbredir.
> > > 
> > > Considering that it is possible to have a connection between
> > > spice-server and spice-gtk where priv->host is not set, this
> > > guard makes sense.
> > 
> > Sorry, I sent it before I've finished.
> > 
> > So, I think the guard makes sense to either solve this in the
> > client or find where in spice-gtk this might be an issue, if it
> > appears to be (not the case so far, IMHO).
> 
> I was not questioning the existence of the test, but wondering if this
> should be
>     g_return_if_fail(priv->host != NULL);
> or
>     if (priv->host == NULL) return;
> 
> Christophe

I think the critical fits, no? Server is asking something while
client is not ready but should be.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20180410/8881ad88/attachment.sig>