Go to file
Uri Lublin 0c1f5b00e7 char-device: spice_char_device_write_to_device: protect against recursion
This fixes Spice's smart card support and is related to
commit 697f3214fd.

Reported-by: Swapna Krishnan <skrishna@redhat.com>

Recursion is now possible starting with spice_char_device_write_to_device
going through spice_char_device_wakeup (after going through qemu),
calling again to spice_char_device_write_to_device.

The protecting code is the same as the one protecting the read path.

This function call loop makes the program to abort with the following messages:

  usb-ccid: chardev: unexpected message of type 3000000
  qemu: qemu_mutex_lock: Resource deadlock avoided

Backtrace:

(gdb) bt
* #0  0x00007ffff3fc78c7 in raise () from /lib64/libc.so.6
* #1  0x00007ffff3fc952a in abort () from /lib64/libc.so.6
* #2  0x0000555555969a95 in error_exit (err=35,
*     msg=0x5555559f8c90 <__func__.5119> "qemu_mutex_lock")
*     at util/qemu-thread-posix.c:48
* #3  0x0000555555969b82 in qemu_mutex_lock (mutex=0x5555562c4d60)
*     at util/qemu-thread-posix.c:79
* #4  0x0000555555714771 in qemu_chr_fe_write (s=0x5555562c4d60,
*     buf=0x7fffffffd2a0 "", len=12) at qemu-char.c:219
* #5  0x000055555586be49 in ccid_card_vscard_send_msg (s=0x5555565c5f80,
*     type=VSC_Error, reader_id=0, payload=0x7fffffffd2e0 "", length=4)
*     at hw/usb/ccid-card-passthru.c:75
* #6  0x000055555586bf00 in ccid_card_vscard_send_error (s=0x5555565c5f80,
*     reader_id=0, code=VSC_GENERAL_ERROR) at
*     hw/usb/ccid-card-passthru.c:91
* #7  0x000055555586c559 in ccid_card_vscard_handle_message (
*     card=0x5555565c5f80, scr_msg_header=0x5555565c6008)
*     at hw/usb/ccid-card-passthru.c:254
* #8  0x000055555586c72f in ccid_card_vscard_read (opaque=0x5555565c5f80,
*     buf=0x5555565034b0 "", size=12) at hw/usb/ccid-card-passthru.c:289
* #9  0x00005555557149db in qemu_chr_be_write (s=0x5555562c4d60,
*     buf=0x5555565034b0 "", len=12) at qemu-char.c:305
* #10 0x000055555571cde5 in vmc_write (sin=0x5555562c4e78,
*     buf=0x5555565034b0 "", len=12) at spice-qemu-char.c:41
* #11 0x00007ffff4fa86aa in spice_char_device_write_to_device (
*     dev=0x55555657f210) at char_device.c:462
* #12 0x00007ffff4fa9b48 in spice_char_device_wakeup (dev=0x55555657f210)
*     at char_device.c:862
* #13 0x00007ffff4ff7658 in spice_server_char_device_wakeup
*     (sin=0x5555562c4e78) at reds.c:2955
* #14 0x000055555571d1d2 in spice_chr_write (chr=0x5555562c4d60,
*     buf=0x7fffffffd560 "", len=12) at spice-qemu-char.c:189
* #15 0x0000555555714789 in qemu_chr_fe_write (s=0x5555562c4d60,
*     buf=0x7fffffffd560 "", len=12) at qemu-char.c:220
* #16 0x000055555586be49 in ccid_card_vscard_send_msg (s=0x5555565c5f80,
*     type=VSC_Error, reader_id=0, payload=0x7fffffffd5a0 "", length=4)
*     at hw/usb/ccid-card-passthru.c:75
* #17 0x000055555586bf00 in ccid_card_vscard_send_error
* (s=0x5555565c5f80,
*     reader_id=0, code=VSC_SUCCESS) at hw/usb/ccid-card-passthru.c:91
* #18 0x000055555586c4fc in ccid_card_vscard_handle_message (
*     card=0x5555565c5f80, scr_msg_header=0x5555565c6008)
*     at hw/usb/ccid-card-passthru.c:242
* #19 0x000055555586c72f in ccid_card_vscard_read (opaque=0x5555565c5f80,
*     buf=0x5555565034b0 "", size=12) at hw/usb/ccid-card-passthru.c:289
* #20 0x00005555557149db in qemu_chr_be_write (s=0x5555562c4d60,
*     buf=0x5555565034b0 "", len=12) at qemu-char.c:305
* #21 0x000055555571cde5 in vmc_write (sin=0x5555562c4e78,
*     buf=0x5555565034b0 "", len=12) at spice-qemu-char.c:41
* #22 0x00007ffff4fa86aa in spice_char_device_write_to_device (
*     dev=0x55555657f210) at char_device.c:462
* #23 0x00007ffff4fa8d37 in spice_char_device_write_buffer_add (
*     dev=0x55555657f210, write_buf=0x555556501f70) at char_device.c:597
* #24 0x00007ffff501142d in smartcard_channel_write_to_reader (
*     write_buf=0x555556501f70) at smartcard.c:669
* #25 0x00007ffff501034c in smartcard_char_device_notify_reader_add (
*     st=0x55555657ef00) at smartcard.c:335
* #26 0x00007ffff50112b3 in smartcard_add_reader (scc=0x555556493ee0,
*     name=0x5555565023cc "E-Gate 0 0") at smartcard.c:642
* #27 0x00007ffff50118d2 in smartcard_channel_handle_message (
*     rcc=0x555556493ee0, type=101, size=22, msg=0x5555565023c0 "\003")
*     at smartcard.c:757
* #28 0x00007ffff4fbc168 in red_peer_handle_incoming
*     (stream=0x555556588250, handler=0x555556497ff0) at red_channel.c:308
* #29 0x00007ffff4fbc231 in red_channel_client_receive
*     (rcc=0x555556493ee0) at red_channel.c:326
* #30 0x00007ffff4fc0019 in red_channel_client_event (fd=59, event=1,
*     data=0x555556493ee0) at red_channel.c:1574
* #31 0x00005555558b6076 in watch_read (opaque=0x5555565002f0)
*     at ui/spice-core.c:101
* #32 0x00005555558e8d48 in qemu_iohandler_poll (pollfds=0x5555562b7630,
*     ret=2) at iohandler.c:143
* #33 0x00005555558e89a4 in main_loop_wait (nonblocking=0) at
* main-loop.c:495
* #34 0x00005555557219b0 in main_loop () at vl.c:1794
* #35 0x0000555555729257 in main (argc=40, argv=0x7fffffffddc8,
*     envp=0x7fffffffdf10) at vl.c:4350
2015-02-08 13:13:46 +02:00
build-aux Update git-version-gen to latest version 2013-12-11 16:32:36 +01:00
docs manual: Add missing closure of XML tag 2014-11-17 17:56:08 +01:00
m4 m4: Update manywarnings from gnulib 2014-10-10 12:39:11 +02:00
server char-device: spice_char_device_write_to_device: protect against recursion 2015-02-08 13:13:46 +02:00
spice-common@5b3cdad921 Add LZ4 compression support. 2014-12-02 19:41:17 +01:00
tests tests/migrate.py: add --vdagent 2011-08-23 17:01:14 +03:00
tools Add casts for compatibility purposes 2012-02-14 10:44:49 +02:00
uncrustify_cfg fresh start 2009-10-14 15:06:41 +02:00
.gitignore Don't ignore all of m4/ in .gitignore 2013-10-10 11:17:17 +02:00
.gitmodules Use the spice-common submodule 2012-03-25 18:59:10 +02:00
.mailmap Add recent new committers to AUTHORS file / mailmap 2012-04-25 09:49:29 +01:00
AUTHORS syntax-check: update AUTHORS 2013-07-16 23:37:28 +03:00
autogen.sh Use the spice-common submodule 2012-03-25 18:59:10 +02:00
cfg.mk Add a few more syntax-check exemptions 2012-04-25 09:49:32 +01:00
ChangeLog fresh start 2009-10-14 15:06:41 +02:00
configure.ac client: Remove client code 2014-12-03 11:31:17 +01:00
COPYING Relicense everything from GPL to LGPL 2.1+ 2010-04-13 22:22:15 +02:00
GNUmakefile Add a 'syntax-check' make target 2012-01-13 18:12:00 +02:00
maint.mk syntax-check: trailing whitespaces -- ignore binary files 2013-07-17 01:59:32 +03:00
Makefile.am client: Remove client code 2014-12-03 11:31:17 +01:00
NEWS Update NEWS 2014-05-19 11:35:14 +02:00
README Revise the spice client and server to use the new snd_codec functions in spice-common. 2014-01-02 12:34:34 +01:00
spice-server.pc.in spice-server.pc.in: move Requires to Requires.private 2011-10-23 11:26:30 +02:00
TODO.multiclient Remove trailing whitespace from end of lines 2012-01-13 18:11:59 +02:00

   SPICE: Simple Protocol for Independent Computing Environments
   =============================================================

SPICE is a remote display system built for virtual environments which
allows you to view a computing 'desktop' environment not only on the
machine where it is running, but from anywhere on the Internet and
from a wide variety of machine architectures.

Installation
------------

The SPICE package uses GNU autotools, so the build install process
follows the standard process documented in the INSTALL file. As a
quick start you can do

  ./configure --prefix=/usr --sysconfdir=/etc \
        --localstatedir=/var --libdir=/usr/lib
  make
  sudo make install

Or to install into a private user specific location

  ./configure --prefix=$HOME/spice
  make
  make install

The following mandatory dependancies are required in order to
build SPICE

    Spice protocol >= 0.9.0
    Pixman         >= 0.17.7
    OpenSSL
    libjpeg
    zlib
    Cyrus-SASL

The following optional dependancies increase the available
functionality

    GE Gui         >= 0.6.0,  < 0.7.0   (GUI app support)
    OpenGL                              (GUI app support)
    Alsa                                (Linux support)
    XRandR         >= 1.2               (X11 support)
    Xinerama       >= 1.0               (X11 support)
    libcacard      >= 0.1.2             (Smartcard support)

Communication
-------------

To communicate with the development team, or to post patches
there is a technical mailing list:

   http://lists.freedesktop.org/mailman/listinfo/spice-devel

There is also a mailing list for new release announcements:

   http://lists.freedesktop.org/archives/spice-announce/

To view known bugs, or report new bugs, in SPICE visit

   https://bugs.freedesktop.org/describecomponents.cgi?product=Spice

Bugs found when using an OS distribution's binary packages should
be reported to the OS vendors' own bug tracker first.

The latest SPICE code can be found in GIT at:

   http://cgit.freedesktop.org/spice/

Licensing
---------

SPICE is provided under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

Please see the COPYING file for the complete LGPLv2+ license
terms, or visit <http://www.gnu.org/licenses/>.

Experimental Features
---------------------
To enable multiple client connections, set:
SPICE_DEBUG_ALLOW_MC=1

-- End of readme