[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2] qdev: Fix use after free in qdev_init_nofail err
From: |
Igor Mammedov |
Subject: |
[Qemu-devel] [PATCH v2] qdev: Fix use after free in qdev_init_nofail error path |
Date: |
Tue, 2 Aug 2016 12:49:20 +0200 |
Since 69382d8b (qdev: Fix object reference leak in case device.realize()
fails), object_property_set_bool releases the device object
in case realize's failed and device hasn't explicitly assigned
parent. It happens due to object_unparent() on error handling
path releases not only implicitly set parent but also calls
device_unparent() which releases the remaining reference hold
buy parent bus.
qdev_try_create() created device has only 1 reference hold by
parent bus which makes impossible to unparent/re-parent object
without destroying it.
Fix it by making caller of qdev_try_create()/qdev_init_nofail()
own a reference from object_new() until qdev_init_nofail() is
successfully executed so that uparenting won't destroy device
until caller owns pointer returned by qdev_try_create().
Signed-off-by: Igor Mammedov <address@hidden>
---
hw/core/qdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index ee4a083..0139d67 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -151,7 +151,6 @@ DeviceState *qdev_try_create(BusState *bus, const char
*type)
}
qdev_set_parent_bus(dev, bus);
- object_unref(OBJECT(dev));
return dev;
}
@@ -360,6 +359,7 @@ void qdev_init_nofail(DeviceState *dev)
object_get_typename(OBJECT(dev)));
exit(1);
}
+ object_unref(OBJECT(dev));
}
void qdev_machine_creation_done(void)
--
2.7.4
- [Qemu-devel] [PATCH v2] qdev: Fix use after free in qdev_init_nofail error path,
Igor Mammedov <=