izzy/xemu
0
0
Fork 0
mirror of https://github.com/izzy2lost/xemu.git synced 2026-07-06 00:20:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

qdev: fix use-after-free in the error path of qdev_init_nofail

Browse Source 
From Markus:

Before:

    $ qemu-system-x86_64 -display none -drive if=ide
    qemu-system-x86_64: Device needs media, but drive is empty
    qemu-system-x86_64: Initialization of device ide-hd failed
    [Exit 1 ]

After:

    $ qemu-system-x86_64 -display none -drive if=ide
    qemu-system-x86_64: Device needs media, but drive is empty
    Segmentation fault (core dumped)
    [Exit 139 (SIGSEGV)]

This error always existed as qdev_init() frees the object.  But QOM
goes a bit further and purposefully sets the class pointer to NULL to
help find use-after-free.  It worked :-)

Cc: Andreas Faerber <afaerber@suse.de>
Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Anthony Liguori
2012-06-27 16:26:59 -05:00
parent d24b569a41
commit 7de3abe505
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hw/qdev.c
+3 -2
View File
@@ -258,9 +258,10 @@ int qdev_simple_unplug_cb(DeviceState *dev)
way is somewhat unclean, and best avoided. */
void qdev_init_nofail(DeviceState *dev)
{
const char *typename = object_get_typename(OBJECT(dev));
if (qdev_init(dev) < 0) {
error_report("Initialization of device %s failed",
object_get_typename(OBJECT(dev)));
error_report("Initialization of device %s failed", typename);
exit(1);
}
}