Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

[Fam Zheng]

On Tue, 08/02 09:55, Igor Mammedov wrote:
>  qdev_init_nofail() { called with ref == 1

Yes it does.

>     object_property_set_bool(true, "realized")
>     if error:
>           ref == 1
            ^

This is not the case for qdev, the object is actually released by
object_property_set_bool if fail.

The problem seems to be that qdev_create doesn't set OBJECT(dev)->parent,
because it eventually calls object_property_add_link instead of
object_property_add_child.

>     else:
>           ref == 2 (+1 for implicitly assigned parent)
>  }

Fam