chardev: close QIOChannel before unref'ing
authorDaniel P. Berrangé <berrange@redhat.com>
Fri, 5 Jan 2024 16:09:52 +0000 (16:09 +0000)
committerDaniel P. Berrangé <berrange@redhat.com>
Fri, 9 Feb 2024 12:50:26 +0000 (12:50 +0000)
commitcb8ded0f6d919a61ef890be14b28e765fba81f66
tree8d4f9c0332cf2a0b91b8fa8e3a78c68a73e3d5de
parent30c917b0d82b1e793d0004ef14792369b7cd80df
chardev: close QIOChannel before unref'ing

The chardev socket backend will unref the QIOChannel object while
it is still potentially open. When using TLS there could be a
pending TLS handshake taking place. If the channel is left open
then when the TLS handshake callback runs, it can end up accessing
free'd memory in the tcp_chr_tls_handshake method.

Closing the QIOChannel will unregister any pending handshake
source.

Reported-by: jiangyegen <jiangyegen@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
chardev/char-socket.c