From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023116.outbound.protection.outlook.com [52.101.72.116]) by lore.virtuozzo.com (Postfix) with ESMTPS id 97EEC80275 for ; Fri, 4 Sep 2026 10:12:20 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ZnEVqpKdORRdgzVs42GLOm5qvMeGxnMlwyUaHwPRVHFta7MooOe7fT6oGfy6Nn8FmwVwM9OWZZK6oPYYdHh+LHRK+EOE7THFkHEewttVMGQBFSj7ew0dQJ0lK5k9YXiGkmC4XdTum+sbW28HBZxxw4GLHZCSmcelJxrqsmTwAry7OZLcjbFEKdWkE679euTdaYCXlqBbQuyP6kyDJK8u5YhdnLwDWl27zdSKwMHmAjEvPnardFhAOcmW51yTlUHu0mM05U4XIkfyfUXXBbw09Q+Msb1QljOFMkwJUGbJVGGwii762Pa52MMo9Tp+DCubdeDUQ1q2mdTwg9NCVAWZ5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=13hzhPUiRVPWPGBMAFT8BdYEivajXRNCSGS521cZMkE=; b=ekRS5EU9/M9lJmYBx3r8YGma4QgNk/OAUhzoCY8HczDASsDKwzAvWC7a1sgrHR+m2gUqBG8t72+R8tNhPXQB3hq9rH+WTAzBweYHtWmyXNCKRJFe0kjGO7fwyuzMYAZ8Uhc+FZz+Oz2qgYfRBVWOng8ptank39X6y125kTrcdLkp1u3lfEzVS5i/rG14efMYbSC/7ufgAV3Xb34QT37hAeue+U5h4IUQrvewm/MDuNVFOvyUUVE6hmMUmgowodCSQS9E9vUQQvUtP3FV5NxcWi+J/gd1snW8Sr1uOADKQJpoTez8qsfqnE2VgUQd5y4ajdQhofjTImQSWBVIVC8rpQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=13hzhPUiRVPWPGBMAFT8BdYEivajXRNCSGS521cZMkE=; b=ZM7cCkibKTD3IKkTrR7vGKvh9p1Wx3Qb4x9pXVuD/4giSDrI/jLGzKc3qHj9QjUp9uF04qpgsL5heh41JT5SvbG6QcRA+Cmn6YE2kDfa2TCkLuT3Rj9blPby5tkOz66yPOC87ITh6rpl/+pVmAG1SiLInRA4OvXHyjqqAo0/BpM5bPC9C3IWTEJyisTu5hTgYfUDWgBMQqWoRiM2d40cUr+h/lbC+7sqZdolXrulqB3Q7k5Y0CjsQqqMxOOP++gYodH5uqsr9jsdq91EydrBkexe1VCbgB2f1P582ZgIvfMhB/K5+054WPNJC2lEG9ZsYmJ3xZMhvU5Y5qxuaDOeIw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:17 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:17 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 01/15] ui/vnc-jobs: fix VncRectEntry leak on job cleanup Date: Fri, 4 Sep 2026 13:11:51 +0300 Message-ID: <20260904101206.701978-2-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 1f79d013-5fcc-4803-95e5-08df0a6cff8b X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: LMbjVRWMWAdahV/6CZDK9Uq5OtRbjwBCt/piLEk38cyEdwLDoxzfyov3YUijKDpNkrYVMPG9tCARQU3FImAG5AVqoF2dlVrx9rDQvtp9NEyviUQiLfNQKVhITpjtNlSsifYQG5gZO9QI52DT0ogJjRVk7imVOeFqWTI9f0URSBqrTs+dSRRpFEBBKlDDcSl4WgYprYqzMMkbCVu/Q59Qc2MqeqKvEH7R09kbGBBWJpFrVeFznyUwTW0LKKN9zXE8CBx6B2mPYvd9gmNZrFcrV81CEEu3hOoYkcNV3Pwpum5Npadv92HYwOW9CjIm1e9o9K8Ukr3iF6irxM2Hq5vLBrQlTW9qaykwldN0Dd3+LUBkCRb8UdgyyuRgRm3P7lG3c/8ivMloAe7BQh4WcZtdhn9n9lhZsN+lkJ1oebFi637nrC/ZIUIM7loo8F2Fz1PNE8awI4LjhwFbmwjGPQBAfcGYHUvtW1y/ekgTH9B0eg4NriocuBc6y0nTyQUJH+PNgEqa8/80DoqKTxVTJAXW00PY17a7XpzJVplZ9CifS7m2s/9sv6IaJTNywzPkQtQlC4l6muxenAdWHb/Bra++GNNwsFx80fVkatX/jwheo0ptQpTzZZ4xB1xiidFerRmXewYKw9syy9fILmXRDtg+3DkA1nhRsqBigzHO4wPpeyWUpzJf/mG6Nlq4OQijsdt/3VUY0IOAIpaAsmu9DCye4/Afv+d4y5uRrc4GnTeHQoo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZnZoQmVJMWNiaWdzbmo5Nk5xOXVjaVhoNXJ3K3FHWG1GZkthOUpsQVUreCs4?= =?utf-8?B?cEZsd3QxRzJYZHVFckxGNE9UWUFrZTlmbllVNEduVFAxWTZ2TmJSVXFRQXNW?= =?utf-8?B?NUJ6NkhmaStKRytwOCtGTG43bEdhZGhxMXpTcy9ENDZpYk4rL0s3ZzBLSStP?= =?utf-8?B?WkVYZGJ6N083RStuNy9ncVRRYjY4a0ltcmp6SVhydDF5dys4QktURkpkWnN0?= =?utf-8?B?dWxlK2tSbWQyK0g2QUJEL0ZpdUh6T1BnOUp6VzVwUlpnVkEvNW9mTkVGS2tW?= =?utf-8?B?Qy9zUDdnRlVuUWMwZTlKSEtmQkZFc3E4RmpGQVhBODd3Q04vN25lSHN3MDJv?= =?utf-8?B?allFRUpVMkFneU5JcEFkSzFmT2ovaHp6cFcwdDZKV1krUno5QVhwbkxXZFhH?= =?utf-8?B?NUVJQlR1eGtzOERoM256ZE53OWFuclQ2NVBIWXhYVEFYVkdNUE1SL2JNQWo5?= =?utf-8?B?R3IrNHlJVmhYMk1qNVZscFJjdzRZeEtRakRYNTQzZk00UndTV3BuTE1ET0sv?= =?utf-8?B?NHF3Q3ppcWM3eXFFbnlpb0crMDJ0RCtjT1FWRmdMVkxnWWJMM0tWSXVyYjQ4?= =?utf-8?B?ZGdTR2J0aEpMWm9tcTl5TFZ0SGRiWTNIOHQrUE1vU1VFbDErSTJUbW1lMzN6?= =?utf-8?B?TVcrejlaRFVzT0M5S1l6VHdUTXBOcUQ5NHBhQmwwRExOMDMrL0d0RDd5Nyt6?= =?utf-8?B?L0NFQTNkaEloL01pc0RKSXJ3NW03Q0lFS0M1ZUFmTGlBVytRaGI5c1ZCazVQ?= =?utf-8?B?eUhXVjlHcDZ5alpRdE9KQkNCWnhFczRjbGgvWTZYR3VEMEM5NVZkMzNVaG5p?= =?utf-8?B?ZGdEckh6anFpWkxyUFBjRzlZU0l2VUVWQXNqaDdtYVVJTFlYZjd0czY3SVRa?= =?utf-8?B?RkhLSDM1aDR2VUZ5SE5OR3lzRWZBNUp1aDBnem0rZzdUdzVsK1U1cFk5RXZC?= =?utf-8?B?Wld0bnlHSTJqMytlWTIrN21qSzlBSHZuajhWVlFoOWowRnVTdjIrcVUveW82?= =?utf-8?B?ZFBVY0NPYm5KMlg2RE1pd3ZtSFlOdUpYc2pvYVdpbmw2NFF2QVJHMWFLVVFx?= =?utf-8?B?TzBDR0s3TEY2eUx2MVJiRnQvaGhJcVlYTE1LcTlPN004aUh2c3dqNENOTnYr?= =?utf-8?B?cDVOU3EyWUhsQ2diOEdFcFF0RGhMZG1IenFnTWNuMmtZZFVZWkVQc2ZKWGdz?= =?utf-8?B?b0ZHdXhWRXowSlB5ZXJMeENDQ1RBZE9rVkEvR0IwM0FLMnJ6cS9XaExPMjN3?= =?utf-8?B?TlZTOGFrOTdNWmJQcjMwSFdHWmpQM3ZjeDBQMXd1elIwa1U0Y1VxRmlUTm9F?= =?utf-8?B?SHJQSTdzQmNQTEwxRUs0QWM1UnFVcW1lSFhrSjIwbWdzSVErK0lobXBUanVn?= =?utf-8?B?czcxdEp0MHlPMU15OGtuWU9zcnI5TDhNNGxGRFZsajlzNExBR1lOYU8zVHBO?= =?utf-8?B?OHBrRDVqM1NFUDJkZ1pCU1ViSW94YUkzNDBGN3VEaS9mNXlyOFcybFJxSEpk?= =?utf-8?B?Ny9vdkdWRm9vcVRsajl4MlozVytlQ3hpSnRraHh1eDVLT2hBVFZQME50Wm5O?= =?utf-8?B?bUZRM2laT0xiNTNhRkNoaldsbUZ1OTI3a0lWd2NDOUtEbkJwUDdGR3JzTS8z?= =?utf-8?B?cjRpUTNRemV1dVN1RnpLNi9DV1VhUUNQYmxmcVV1Wm1JVGtpUWd6QlZjZXY3?= =?utf-8?B?ZEVnQkkyQWlCTkRLVGoyeW92S3VIM09WNWhocGNGQllDcmNTU1E4WFJOSGRm?= =?utf-8?B?aUN4QThCcEthZFBtQmVHeHR6SXpOeGE1YkxzK1Q5THVNTUZoQkNFTk5HR1ZH?= =?utf-8?B?bzB0QnRzazgzNHlSdEozSmhpMHhmY2pidFB6eENZYXZwSzBGWnl2d0E5SW1k?= =?utf-8?B?d1ZTdUwydE5YakhPU1Z1QVBnRERaZkg4bWFRdkQwTnFqLytGbHVrb0xwMG80?= =?utf-8?B?OTZKeTd4cGZFZ2h0Z0s0ZjRzQmRkMTdxVVNJY2UxdUdJd1Bnc2V4SW1nSjVT?= =?utf-8?B?TnBQeEtDUDdUL3d4UEFibDE1WVZDakxNTm9idEY1NllIbkp2dXByUUM0YlQ0?= =?utf-8?B?QVJ2eDNSbTFDdmRlYmgzVHZCUWlublZ6VEoxSmd1eFR6QU1pSXc2UVJEbGJv?= =?utf-8?B?c2NlamY1MStHQkFEU0xoWmVFRjVRTDVuRUlTTlR0Q214WFJkUFAxSmRHYUlE?= =?utf-8?B?MFhPU2owWjV2bFhaU1BmTVFTMWNZYVpyeW5acG4xQXJOMTVvK0VXUWh0cFR6?= =?utf-8?B?T3RCWWducEt6eVhuS3JMc3RBVExrWVBaUG10dWhPeFM5ZGxTekFneUI5Ymxk?= =?utf-8?B?MHUyekIvT3ptMmJKUUJGcFp4b3VtL3cyVy9hb1ZaUjUvNk5kNVc2ZXNVbEZG?= =?utf-8?Q?rstTTs77/3q2cgvE=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1f79d013-5fcc-4803-95e5-08df0a6cff8b X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:17.1708 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZIy67OuFU3M/rtPk/j/bF2WCbQicscUxMuM1FH8wzyiVyWbpPv3Bwy08KhrYla6123DhokPtFrVntG5a83xJgJSTs8MUTAwCAoYUIShA9Sc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Marc-André Lureau When a VncJob is freed, its associated VncRectEntry list must also be freed. Previously, vnc_job_push() and the disconnected path in vnc_worker_thread_loop() called g_free(job) directly, leaking all VncRectEntry allocations. Introduce vnc_job_free() which iterates and frees the rectangle entries before freeing the job itself, and use it in both paths. Also add QLIST_REMOVE() in the worker loop before g_free(entry), so that entries processed during normal operation are properly unlinked. Without this, vnc_job_free() would iterate dangling pointers to already-freed entries, causing use-after-free. Fixes: bd023f953e5e ("vnc: threaded VNC server") Reviewed-by: Daniel P. Berrangé Signed-off-by: Marc-André Lureau (cherry picked from commit 3cae0b46be5416b26039df5259ffc8fcf2989516) Signed-off-by: Michael Tokarev (cherry picked from commit ccffe22759e733f002c19d762431441d8570fdda) --- ui/vnc-jobs.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c index bed33950a87..d2a3c676b0e 100644 --- a/ui/vnc-jobs.c +++ b/ui/vnc-jobs.c @@ -108,11 +108,25 @@ int vnc_job_add_rect(VncJob *job, int x, int y, int w, int h) return 1; } +static void vnc_job_free(VncJob *job) +{ + VncRectEntry *entry, *tmp; + + if (!job) { + return; + } + QLIST_FOREACH_SAFE(entry, &job->rectangles, next, tmp) { + /* no need for QLIST_REMOVE(entry, next) */ + g_free(entry); + } + g_free(job); +} + void vnc_job_push(VncJob *job) { vnc_lock_queue(queue); if (queue->exit || QLIST_EMPTY(&job->rectangles)) { - g_free(job); + vnc_job_free(job); } else { QTAILQ_INSERT_TAIL(&queue->jobs, job, next); qemu_cond_broadcast(&queue->cond); @@ -297,6 +311,7 @@ static int vnc_worker_thread_loop(VncJobQueue *queue) n_rectangles += n; } } + QLIST_REMOVE(entry, next); g_free(entry); } trace_vnc_job_nrects(&vs, job, n_rectangles); @@ -325,7 +340,7 @@ disconnected: QTAILQ_REMOVE(&queue->jobs, job, next); vnc_unlock_queue(queue); qemu_cond_broadcast(&queue->cond); - g_free(job); + vnc_job_free(job); vs.magic = 0; return 0; } -- 2.47.1