From patchwork Wed Jun 27 12:41:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Anthony Liguori X-Patchwork-Id: 167645 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id C711DB6FAB for ; Wed, 27 Jun 2012 22:52:49 +1000 (EST) Received: from localhost ([::1]:57709 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Sjrjj-00056M-D1 for incoming@patchwork.ozlabs.org; Wed, 27 Jun 2012 08:52:47 -0400 Received: from eggs.gnu.org ([208.118.235.92]:53487) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SjrjW-00054e-H1 for qemu-devel@nongnu.org; Wed, 27 Jun 2012 08:52:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SjrjL-00017A-Pd for qemu-devel@nongnu.org; Wed, 27 Jun 2012 08:52:34 -0400 Received: from e33.co.us.ibm.com ([32.97.110.151]:53060) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SjrjL-00015o-JJ for qemu-devel@nongnu.org; Wed, 27 Jun 2012 08:52:23 -0400 Received: from /spool/local by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 27 Jun 2012 06:52:19 -0600 Received: from d01dlp03.pok.ibm.com (9.56.224.17) by e33.co.us.ibm.com (192.168.1.133) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 27 Jun 2012 06:41:39 -0600 Received: from d01relay02.pok.ibm.com (d01relay02.pok.ibm.com [9.56.227.234]) by d01dlp03.pok.ibm.com (Postfix) with ESMTP id 4F0F3C90050 for ; Wed, 27 Jun 2012 08:41:24 -0400 (EDT) Received: from d01av03.pok.ibm.com (d01av03.pok.ibm.com [9.56.224.217]) by d01relay02.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q5RCfPYn184218 for ; Wed, 27 Jun 2012 08:41:26 -0400 Received: from d01av03.pok.ibm.com (loopback [127.0.0.1]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q5RCfPrl023639 for ; Wed, 27 Jun 2012 09:41:25 -0300 Received: from titi.austin.rr.com (sig-9-65-133-147.mts.ibm.com [9.65.133.147]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q5RCfOcv023541; Wed, 27 Jun 2012 09:41:25 -0300 From: Anthony Liguori To: qemu-devel@nongnu.org Date: Wed, 27 Jun 2012 07:41:24 -0500 Message-Id: <1340800884-4571-1-git-send-email-aliguori@us.ibm.com> X-Mailer: git-send-email 1.7.5.4 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12062712-2398-0000-0000-000007EFBA56 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 32.97.110.151 Cc: Anthony Liguori , Markus Armbruster , Andreas Faerber Subject: [Qemu-devel] [PATCH] qdev: fix use-after-free in the error path of qdev_init_nofail X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From Markus: Before: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty qemu-system-x86_64: Initialization of device ide-hd failed [Exit 1 ] After: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty Segmentation fault (core dumped) [Exit 139 (SIGSEGV)] This error always existed as qdev_init() frees the object. But QOM goes a bit further and purposefully sets the class pointer to NULL to help find use-after-free. It worked :-) Cc: Andreas Faerber Reported-by: Markus Armbruster Signed-off-by: Anthony Liguori Reviewed-by: Andreas Färber Tested-by: Markus Armbruster --- hw/qdev.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index a6c4c02..af54467 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -258,9 +258,10 @@ int qdev_simple_unplug_cb(DeviceState *dev) way is somewhat unclean, and best avoided. */ void qdev_init_nofail(DeviceState *dev) { + const char *typename = object_get_typename(OBJECT(dev)); + if (qdev_init(dev) < 0) { - error_report("Initialization of device %s failed", - object_get_typename(OBJECT(dev))); + error_report("Initialization of device %s failed", typename); exit(1); } }