io: fix cleanup for TLS I/O source data on cancellation
The TLS code will create a GSource for tracking completion of the handshake process, passing a QIOChannelTLSData struct that contains various data items. The data struct is freed by the callback when it completes, which means when a source is cancelled, nothing is free'ing the data struct or its contents. Switch to provide a data free callback to the GSource, which ensures the QIOChannelTLSData struct is always freed even when the main event callback never fires. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3114 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Daniel P. Berrangé committed
Jan 6, 2026 at 13:45 UTC
d39d0f3acdd7c1bb275db7e97b511f98254ecd9f
1 file changed
+43
-25
io/channel-tls.c
+43
-25
@@ -153,13 +153,32 @@ struct QIOChannelTLSData {
153
};
154
typedef struct QIOChannelTLSData QIOChannelTLSData;
155
156
+static void qio_channel_tls_io_data_free(gpointer user_data)
157
+{
158
+ QIOChannelTLSData *data = user_data;
159
+ /*
160
+ * Usually 'task' will be NULL since the GSource
161
+ * callback will either complete the task or pass
162
+ * it on to a new GSource. We'll see a non-NULL
163
+ * task here only if the GSource was released before
164
+ * its callback triggers
165
+ */
166
+ if (data->task) {
167
+ qio_task_free(data->task);
168
+ }
169
+ if (data->context) {
170
+ g_main_context_unref(data->context);
171
+ }
172
+ g_free(data);
173
+}
174
+
175
static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
176
GIOCondition condition,
177
gpointer user_data);
178
160
-static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
161
- QIOTask *task,
162
- GMainContext *context)
179
+static gboolean qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
180
+ QIOTask *task,
181
+ GMainContext *context)
182
{
183
Error *err = NULL;
184
int status;
@@ -170,8 +189,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
189
trace_qio_channel_tls_handshake_fail(ioc);
190
qio_task_set_error(task, err);
191
qio_task_complete(task);
173
- qio_task_free(task);
174
- return;
192
+ return TRUE;
193
}
194
195
if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
@@ -184,7 +202,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
202
trace_qio_channel_tls_credentials_allow(ioc);
203
}
204
qio_task_complete(task);
187
- qio_task_free(task);
205
+ return TRUE;
206
} else {
207
GIOCondition condition;
208
QIOChannelTLSData *data = g_new0(typeof(*data), 1);
@@ -208,8 +226,9 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
226
condition,
227
qio_channel_tls_handshake_io,
228
data,
211
- NULL,
229
+ qio_channel_tls_io_data_free,
230
context);
231
+ return FALSE;
232
}
233
}
234
@@ -225,11 +244,9 @@ static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
244
qio_task_get_source(task));
245
246
tioc->hs_ioc_tag = 0;
228
- g_free(data);
229
- qio_channel_tls_handshake_task(tioc, task, context);
230
-
231
- if (context) {
232
- g_main_context_unref(context);
247
+ if (!qio_channel_tls_handshake_task(tioc, task, context)) {
248
+ /* task is kept by new GSource so must not be released yet */
249
+ data->task = NULL;
250
}
251
252
return FALSE;
@@ -252,14 +269,16 @@ void qio_channel_tls_handshake(QIOChannelTLS *ioc,
269
func, opaque, destroy);
270
271
trace_qio_channel_tls_handshake_start(ioc);
255
- qio_channel_tls_handshake_task(ioc, task, context);
272
+ if (qio_channel_tls_handshake_task(ioc, task, context)) {
273
+ qio_task_free(task);
274
+ }
275
}
276
277
static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condition,
278
gpointer user_data);
279
261
-static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task,
262
- GMainContext *context)
280
+static gboolean qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task,
281
+ GMainContext *context)
282
{
283
GIOCondition condition;
284
QIOChannelTLSData *data;
@@ -272,14 +291,12 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task,
291
trace_qio_channel_tls_bye_fail(ioc);
292
qio_task_set_error(task, err);
293
qio_task_complete(task);
275
- qio_task_free(task);
276
- return;
294
+ return TRUE;
295
}
296
297
if (status == QCRYPTO_TLS_BYE_COMPLETE) {
298
qio_task_complete(task);
281
- qio_task_free(task);
282
- return;
299
+ return TRUE;
300
}
301
302
data = g_new0(typeof(*data), 1);
@@ -299,7 +316,10 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task,
316
trace_qio_channel_tls_bye_pending(ioc, status);
317
ioc->bye_ioc_tag = qio_channel_add_watch_full(ioc->master, condition,
318
qio_channel_tls_bye_io,
302
- data, NULL, context);
319
+ data,
320
+ qio_channel_tls_io_data_free,
321
+ context);
322
+ return FALSE;
323
}
324
325
@@ -312,11 +332,9 @@ static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condition,
332
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(qio_task_get_source(task));
333
334
tioc->bye_ioc_tag = 0;
315
- g_free(data);
316
- qio_channel_tls_bye_task(tioc, task, context);
317
-
318
- if (context) {
319
- g_main_context_unref(context);
335
+ if (!qio_channel_tls_bye_task(tioc, task, context)) {
336
+ /* task is kept by new GSource so must not be released yet */
337
+ data->task = NULL;
338
}
339
340
return FALSE;