[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 01/13] ide: ahci: unparent children buses before free
From: |
John Snow |
Subject: |
[Qemu-devel] [PULL 01/13] ide: ahci: unparent children buses before freeing their memory |
Date: |
Mon, 18 Sep 2017 20:11:35 -0400 |
From: Igor Mammedov <address@hidden>
Fixes read after freeing error reported
https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04243.html
Message-Id: <address@hidden>
ich9-ahci device creates ide buses and attaches them as QOM children
at realize time, however it forgets to properly clean them up
at unrealize time and frees memory containing these children,
with following call-chain:
qdev_device_add()
object_property_set_bool('realized', true)
device_set_realized()
...
pci_qdev_realize() -> pci_ich9_ahci_realize() -> ahci_realize()
...
s->dev = g_new0(AHCIDevice, ports);
...
AHCIDevice *ad = &s->dev[i];
ide_bus_new(&ad->port, sizeof(ad->port), qdev, i, 1);
^^^ creates bus in memory allocated by above gnew()
and adds it as child propety to ahci device
...
hotplug_handler_plug(); -> goto post_realize_fail;
pci_qdev_unrealize() -> pci_ich9_uninit() -> ahci_uninit()
...
g_free(s->dev);
^^^ free memory that holds children busses
return with error from device_set_realized()
As result later when qdev_device_add() tries to unparent ich9-ahci
after failed device_set_realized(),
object_unparent() -> object_property_del_child()
iterates over existing QOM children including buses added by
ide_bus_new() and tries to unparent them, which causes access to
freed memory where they where located.
Reported-by: Thomas Huth <address@hidden>
Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Tested-by: Thomas Huth <address@hidden>
Reviewed-by: John Snow <address@hidden>
Message-id: address@hidden
Signed-off-by: John Snow <address@hidden>
---
hw/ide/ahci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 406a1b5..ccbe091 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1495,6 +1495,7 @@ void ahci_uninit(AHCIState *s)
ide_exit(s);
}
+ object_unparent(OBJECT(&ad->port));
}
g_free(s->dev);
--
2.9.5
- [Qemu-devel] [PULL 13/13] hw/block/fdc: Convert to realize, John Snow, 2017/09/18
- [Qemu-devel] [PULL 01/13] ide: ahci: unparent children buses before freeing their memory,
John Snow <=
- [Qemu-devel] [PULL 00/13] Ide patches, John Snow, 2017/09/18
- [Qemu-devel] [PULL 02/13] hw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = false, John Snow, 2017/09/18
- [Qemu-devel] [PULL 03/13] IDE: replace DEBUG_IDE with tracing system, John Snow, 2017/09/18
- [Qemu-devel] [PULL 04/13] IDE: Add register hints to tracing, John Snow, 2017/09/18
- [Qemu-devel] [PULL 05/13] IDE: add tracing for data ports, John Snow, 2017/09/18
- [Qemu-devel] [PULL 06/13] ATAPI: Replace DEBUG_IDE_ATAPI with tracing events, John Snow, 2017/09/18
- [Qemu-devel] [PULL 07/13] IDE: replace DEBUG_AIO with trace events, John Snow, 2017/09/18
- [Qemu-devel] [PULL 10/13] AHCI: pretty-print FIS to buffer instead of stderr, John Snow, 2017/09/18
- [Qemu-devel] [PULL 09/13] AHCI: Rework IRQ constants, John Snow, 2017/09/18