[Qemu-devel] [PATCH v3] use qemu_malloc and friends consistently

[Jean-Christophe Dubois]

qemu_malloc, qemu_free and friends are not used consistently in the qemu
source code.

This is an attempt to use these oveloaded functions consistently all over
the place instead of the default glibc versions.

version 2 avoids to use qemu_malloc in qemu-io.c if the size to allocate is 0.

Since the submission of version 2 of the patch a lot of places have been
patched. But there are still a lot of other places where malloc/free is used
instead of qemu_malloc/qemu_free.

Version 3 of the patch is applying the fix where it has not yet been applied.

Signed-off-by: Jean-Christophe DUBOIS <address@hidden>

---
 acl.c                 |    4 ++--
 audio/paaudio.c       |    4 ++--
 block/cloop.c         |    6 +++---
 block/dmg.c           |   14 +++++++-------
 block/vvfat.c         |   36 ++++++++++++++++++------------------
 bsd-user/main.c       |    6 +++---
 bsd-user/path.c       |   10 +++++-----
 hw/baum.c             |    8 ++++----
 hw/bt-l2cap.c         |    2 +-
 hw/nseries.c          |    2 +-
 hw/scsi-generic.c     |    4 ++--
 linux-user/main.c     |   10 +++++-----
 linux-user/syscall.c  |   16 ++++++++--------
 migration.c           |    2 +-
 net.c                 |   30 +++++++++++++++---------------
 qemu-char.c           |   12 ++++++------
 qemu-img.c            |    2 +-
 qemu-io.c             |   12 ++++++------
 readline.c            |    2 +-
 slirp/socket.c        |    8 ++++----
 target-arm/helper.c   |    4 ++--
 target-i386/helper.c  |    4 ++--
 target-i386/kvm.c     |    2 +-
 target-ppc/kvm_ppc.c  |    2 +-
 target-sparc/helper.c |    8 ++++----
 tcg/tcg.c             |    6 +++---
 vl.c                  |    6 +++---
 27 files changed, 111 insertions(+), 111 deletions(-)

diff --git a/acl.c b/acl.c
index f69db25..3b1013c 100644
--- a/acl.c
+++ b/acl.c
@@ -104,8 +104,8 @@ void qemu_acl_reset(qemu_acl *acl)
     acl->defaultDeny = 1;
     TAILQ_FOREACH(entry, &acl->entries, next) {
         TAILQ_REMOVE(&acl->entries, entry, next);
-        free(entry->match);
-        free(entry);
+        qemu_free(entry->match);
+        qemu_free(entry);
     }
     acl->nentries = 0;
 }
diff --git a/audio/paaudio.c b/audio/paaudio.c
index ff43bdd..a50fccc 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -340,7 +340,7 @@ static int qpa_init_out (HWVoiceOut *hw, struct audsettings 
*as)
     return 0;
 
  fail3:
-    free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     pa_simple_free (pa->s);
@@ -394,7 +394,7 @@ static int qpa_init_in (HWVoiceIn *hw, struct audsettings 
*as)
     return 0;
 
  fail3:
-    free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     pa_simple_free (pa->s);
diff --git a/block/cloop.c b/block/cloop.c
index 06c687e..709b7d6 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -148,9 +148,9 @@ static void cloop_close(BlockDriverState *bs)
     BDRVCloopState *s = bs->opaque;
     close(s->fd);
     if(s->n_blocks>0)
-       free(s->offsets);
-    free(s->compressed_block);
-    free(s->uncompressed_block);
+       qemu_free(s->offsets);
+    qemu_free(s->compressed_block);
+    qemu_free(s->uncompressed_block);
     inflateEnd(&s->zstream);
 }
 
diff --git a/block/dmg.c b/block/dmg.c
index 262560f..14ebe59 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -273,14 +273,14 @@ static void dmg_close(BlockDriverState *bs)
     BDRVDMGState *s = bs->opaque;
     close(s->fd);
     if(s->n_chunks>0) {
-       free(s->types);
-       free(s->offsets);
-       free(s->lengths);
-       free(s->sectors);
-       free(s->sectorcounts);
+       qemu_free(s->types);
+       qemu_free(s->offsets);
+       qemu_free(s->lengths);
+       qemu_free(s->sectors);
+       qemu_free(s->sectorcounts);
     }
-    free(s->compressed_chunk);
-    free(s->uncompressed_chunk);
+    qemu_free(s->compressed_chunk);
+    qemu_free(s->uncompressed_chunk);
     inflateEnd(&s->zstream);
 }
 
diff --git a/block/vvfat.c b/block/vvfat.c
index 097c9f6..5b6ddec 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -87,7 +87,7 @@ static inline void array_init(array_t* array,unsigned int 
item_size)
 static inline void array_free(array_t* array)
 {
     if(array->pointer)
-        free(array->pointer);
+        qemu_free(array->pointer);
     array->size=array->next=0;
 }
 
@@ -169,7 +169,7 @@ static inline int array_roll(array_t* array,int 
index_to,int index_from,int coun
 
     memcpy(to,buf,is*count);
 
-    free(buf);
+    qemu_free(buf);
 
     return 0;
 }
@@ -732,7 +732,7 @@ static int read_directory(BDRVVVFATState* s, int 
mapping_index)
        snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
 
        if(stat(buffer,&st)<0) {
-           free(buffer);
+           qemu_free(buffer);
             continue;
        }
 
@@ -755,7 +755,7 @@ static int read_directory(BDRVVVFATState* s, int 
mapping_index)
            direntry->begin=0; /* do that later */
         if (st.st_size > 0x7fffffff) {
            fprintf(stderr, "File %s is larger than 2GB\n", buffer);
-           free(buffer);
+           qemu_free(buffer);
            return -2;
         }
        direntry->size=cpu_to_le32(S_ISDIR(st.st_mode)?0:st.st_size);
@@ -882,7 +882,7 @@ static int init_directories(BDRVVVFATState* s,
     mapping->dir_index = 0;
     mapping->info.dir.parent_mapping_index = -1;
     mapping->first_mapping_index = -1;
-    mapping->path = strdup(dirname);
+    mapping->path = qemu_strdup(dirname);
     i = strlen(mapping->path);
     if (i > 0 && mapping->path[i - 1] == '/')
        mapping->path[i - 1] = '\0';
@@ -1369,7 +1369,7 @@ DLOG(fprintf(stderr, "clear_commits (%d commits)\n", 
s->commits.next));
        assert(commit->path || commit->action == ACTION_WRITEOUT);
        if (commit->action != ACTION_WRITEOUT) {
            assert(commit->path);
-           free(commit->path);
+           qemu_free(commit->path);
        } else
            assert(commit->path == NULL);
     }
@@ -1632,10 +1632,10 @@ static uint32_t 
get_cluster_count_for_direntry(BDRVVVFATState* s,
 
            /* rename */
            if (strcmp(basename, basename2))
-               schedule_rename(s, cluster_num, strdup(path));
+               schedule_rename(s, cluster_num, qemu_strdup(path));
        } else if (is_file(direntry))
            /* new file */
-           schedule_new_file(s, strdup(path), cluster_num);
+           schedule_new_file(s, qemu_strdup(path), cluster_num);
        else {
            assert(0);
            return 0;
@@ -1752,10 +1752,10 @@ static int check_directory_consistency(BDRVVVFATState 
*s,
        mapping->mode &= ~MODE_DELETED;
 
        if (strcmp(basename, basename2))
-           schedule_rename(s, cluster_num, strdup(path));
+           schedule_rename(s, cluster_num, qemu_strdup(path));
     } else
        /* new directory */
-       schedule_mkdir(s, cluster_num, strdup(path));
+       schedule_mkdir(s, cluster_num, qemu_strdup(path));
 
     lfn_init(&lfn);
     do {
@@ -1776,7 +1776,7 @@ DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", 
(int)cluster_num, (int)clu
        if (subret) {
            fprintf(stderr, "Error fetching direntries\n");
        fail:
-           free(cluster);
+           qemu_free(cluster);
            return 0;
        }
 
@@ -1844,7 +1844,7 @@ DLOG(fprintf(stderr, "check direntry %d: \n", i); 
print_direntry(direntries + i)
        cluster_num = modified_fat_get(s, cluster_num);
     } while(!fat_eof(s, cluster_num));
 
-    free(cluster);
+    qemu_free(cluster);
     return ret;
 }
 
@@ -1990,7 +1990,7 @@ static int remove_mapping(BDRVVVFATState* s, int 
mapping_index)
 
     /* free mapping */
     if (mapping->first_mapping_index < 0)
-       free(mapping->path);
+       qemu_free(mapping->path);
 
     /* remove from s->mapping */
     array_remove(&(s->mapping), mapping_index);
@@ -2400,7 +2400,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
                }
            }
 
-           free(old_path);
+           qemu_free(old_path);
            array_remove(&(s->commits), i);
            continue;
        } else if (commit->action == ACTION_MKDIR) {
@@ -2768,7 +2768,7 @@ static int write_target_commit(BlockDriverState *bs, 
int64_t sector_num,
 static void write_target_close(BlockDriverState *bs) {
     BDRVVVFATState* s = bs->opaque;
     bdrv_delete(s->qcow);
-    free(s->qcow_filename);
+    qemu_free(s->qcow_filename);
 }
 
 static BlockDriver vvfat_write_target = {
@@ -2782,7 +2782,7 @@ static int enable_write_target(BDRVVVFATState *s)
     BlockDriver *bdrv_qcow;
     QEMUOptionParameter *options;
     int size = sector2cluster(s, s->sector_count);
-    s->used_clusters = calloc(size, 1);
+    s->used_clusters = qemu_mallocz(size);
 
     array_init(&(s->commits), sizeof(commit_t));
 
@@ -2804,7 +2804,7 @@ static int enable_write_target(BDRVVVFATState *s)
     unlink(s->qcow_filename);
 #endif
 
-    s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
+    s->bs->backing_hd = qemu_mallocz(sizeof(BlockDriverState));
     s->bs->backing_hd->drv = &vvfat_write_target;
     s->bs->backing_hd->opaque = s;
 
@@ -2820,7 +2820,7 @@ static void vvfat_close(BlockDriverState *bs)
     array_free(&(s->directory));
     array_free(&(s->mapping));
     if(s->cluster_buffer)
-        free(s->cluster_buffer);
+        qemu_free(s->cluster_buffer);
 }
 
 static BlockDriver bdrv_vvfat = {
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 827c9c3..c2c9c17 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -822,7 +822,7 @@ int main(int argc, char **argv)
     while (*(wrk++))
         environ_count++;
 
-    target_environ = malloc((environ_count + 1) * sizeof(char *));
+    target_environ = qemu_malloc((environ_count + 1) * sizeof(char *));
     if (!target_environ)
         abort();
     for (wrk = environ, dst = target_environ; *wrk; wrk++) {
@@ -838,10 +838,10 @@ int main(int argc, char **argv)
     }
 
     for (wrk = target_environ; *wrk; wrk++) {
-        free(*wrk);
+        qemu_free(*wrk);
     }
 
-    free(target_environ);
+    qemu_free(target_environ);
 
     if (qemu_log_enabled()) {
         log_page_dump();
diff --git a/bsd-user/path.c b/bsd-user/path.c
index 5c40ec7..56831b3 100644
--- a/bsd-user/path.c
+++ b/bsd-user/path.c
@@ -45,8 +45,8 @@ static struct pathelem *new_entry(const char *root,
                                   struct pathelem *parent,
                                   const char *name)
 {
-    struct pathelem *new = malloc(sizeof(*new));
-    new->name = strdup(name);
+    struct pathelem *new = qemu_malloc(sizeof(*new));
+    new->name = qemu_strdup(name);
     asprintf(&new->pathname, "%s/%s", root, name);
     new->num_entries = 0;
     return new;
@@ -75,7 +75,7 @@ static struct pathelem *add_entry(struct pathelem *root, 
const char *name)
 {
     root->num_entries++;
 
-    root = realloc(root, sizeof(*root)
+    root = qemu_realloc(root, sizeof(*root)
                    + sizeof(root->entries[0])*root->num_entries);
 
     root->entries[root->num_entries-1] = new_entry(root->pathname, root, name);
@@ -137,14 +137,14 @@ void init_paths(const char *prefix)
         pstrcpy(pref_buf, sizeof(pref_buf), cwd);
         pstrcat(pref_buf, pref_buf_len, "/");
         pstrcat(pref_buf, pref_buf_len, prefix);
-        free(cwd);
+        qemu_free(cwd);
     } else
         pstrcpy(pref_buf, sizeof(pref_buf), prefix + 1);
 
     base = new_entry("", NULL, pref_buf);
     base = add_dir_maybe(base);
     if (base->num_entries == 0) {
-        free (base);
+        qemu_free (base);
         base = NULL;
     } else {
         set_parents(base, base);
diff --git a/hw/baum.c b/hw/baum.c
index b47ea34..b40ccbe 100644
--- a/hw/baum.c
+++ b/hw/baum.c
@@ -558,7 +558,7 @@ static void baum_chr_read(void *opaque)
     if (ret == -1 && (brlapi_errno != BRLAPI_ERROR_LIBCERR || errno != EINTR)) 
{
         brlapi_perror("baum: brlapi_readKey");
         brlapi__closeConnection(baum->brlapi);
-        free(baum->brlapi);
+        qemu_free(baum->brlapi);
         baum->brlapi = NULL;
     }
 }
@@ -621,9 +621,9 @@ fail:
     qemu_free_timer(baum->cellCount_timer);
     brlapi__closeConnection(handle);
 fail_handle:
-    free(handle);
-    free(chr);
-    free(baum);
+    qemu_free(handle);
+    qemu_free(chr);
+    qemu_free(baum);
     return NULL;
 }
 
diff --git a/hw/bt-l2cap.c b/hw/bt-l2cap.c
index b22b761..7403972 100644
--- a/hw/bt-l2cap.c
+++ b/hw/bt-l2cap.c
@@ -1220,7 +1220,7 @@ static void l2cap_teardown(struct l2cap_instance_s 
*l2cap, int send_disconnect)
     for (cid = L2CAP_CID_ALLOC; cid < L2CAP_CID_MAX; cid ++)
         if (l2cap->cid[cid]) {
             l2cap->cid[cid]->params.close(l2cap->cid[cid]->params.opaque);
-            free(l2cap->cid[cid]);
+            qemu_free(l2cap->cid[cid]);
         }
 
     if (l2cap->role)
diff --git a/hw/nseries.c b/hw/nseries.c
index b412aa0..80da80a 100644
--- a/hw/nseries.c
+++ b/hw/nseries.c
@@ -711,7 +711,7 @@ static void n800_dss_init(struct rfbi_chip_s *chip)
     fb_blank = memset(qemu_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
     /* Display Memory Data Port */
     chip->block(chip->opaque, 1, fb_blank, 800 * 480 * 2, 800);
-    free(fb_blank);
+    qemu_free(fb_blank);
 }
 
 static void n8x0_dss_setup(struct n800_s *s)
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index c827c04..5983bae 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -564,7 +564,7 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t 
tag,
 
     if (len == 0) {
         if (r->buf != NULL)
-            free(r->buf);
+            qemu_free(r->buf);
         r->buflen = 0;
         r->buf = NULL;
         ret = execute_command(s->bdrv, r, SG_DXFER_NONE, 
scsi_command_complete);
@@ -577,7 +577,7 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t 
tag,
 
     if (r->buflen != len) {
         if (r->buf != NULL)
-            free(r->buf);
+            qemu_free(r->buf);
         r->buf = qemu_malloc(len);
         r->buflen = len;
     }
diff --git a/linux-user/main.c b/linux-user/main.c
index 7eabd0c..f90d844 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -2549,7 +2549,7 @@ int main(int argc, char **argv, char **envp)
      * Prepare copy of argv vector for target.
      */
     target_argc = argc - optind;
-    target_argv = calloc(target_argc + 1, sizeof (char *));
+    target_argv = qemu_mallocz((target_argc + 1) * sizeof (char *));
     if (target_argv == NULL) {
        (void) fprintf(stderr, "Unable to allocate memory for target_argv\n");
        exit(1);
@@ -2583,15 +2583,15 @@ int main(int argc, char **argv, char **envp)
     }
 
     for (i = 0; i < target_argc; i++) {
-        free(target_argv[i]);
+        qemu_free(target_argv[i]);
     }
-    free(target_argv);
+    qemu_free(target_argv);
 
     for (wrk = target_environ; *wrk; wrk++) {
-        free(*wrk);
+        qemu_free(*wrk);
     }
 
-    free(target_environ);
+    qemu_free(target_environ);
 
     if (qemu_log_enabled()) {
         log_page_dump();
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 53a11ab..14df8aa 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2166,7 +2166,7 @@ static inline abi_long target_to_host_semarray(int semid, 
unsigned short **host_
 
     nsems = semid_ds.sem_nsems;
 
-    *host_array = malloc(nsems*sizeof(unsigned short));
+    *host_array = qemu_malloc(nsems*sizeof(unsigned short));
     array = lock_user(VERIFY_READ, target_addr,
                       nsems*sizeof(unsigned short), 1);
     if (!array)
@@ -2205,7 +2205,7 @@ static inline abi_long host_to_target_semarray(int semid, 
abi_ulong target_addr,
     for(i=0; i<nsems; i++) {
         __put_user((*host_array)[i], &array[i]);
     }
-    free(*host_array);
+    qemu_free(*host_array);
     unlock_user(array, target_addr, 1);
 
     return 0;
@@ -2451,11 +2451,11 @@ static inline abi_long do_msgsnd(int msqid, abi_long 
msgp,
 
     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
         return -TARGET_EFAULT;
-    host_mb = malloc(msgsz+sizeof(long));
+    host_mb = qemu_malloc(msgsz+sizeof(long));
     host_mb->mtype = (abi_long) tswapl(target_mb->mtype);
     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
     ret = get_errno(msgsnd(msqid, host_mb, msgsz, msgflg));
-    free(host_mb);
+    qemu_free(host_mb);
     unlock_user_struct(target_mb, msgp, 0);
 
     return ret;
@@ -2473,7 +2473,7 @@ static inline abi_long do_msgrcv(int msqid, abi_long msgp,
     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
         return -TARGET_EFAULT;
 
-    host_mb = malloc(msgsz+sizeof(long));
+    host_mb = qemu_malloc(msgsz+sizeof(long));
     ret = get_errno(msgrcv(msqid, host_mb, msgsz, tswapl(msgtyp), msgflg));
 
     if (ret > 0) {
@@ -2488,7 +2488,7 @@ static inline abi_long do_msgrcv(int msqid, abi_long msgp,
     }
 
     target_mb->mtype = tswapl(host_mb->mtype);
-    free(host_mb);
+    qemu_free(host_mb);
 
 end:
     if (target_mb)
@@ -5756,7 +5756,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             struct linux_dirent *dirp;
             abi_long count = arg3;
 
-           dirp = malloc(count);
+           dirp = qemu_malloc(count);
            if (!dirp) {
                 ret = -TARGET_ENOMEM;
                 goto fail;
@@ -5794,7 +5794,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                ret = count1;
                 unlock_user(target_dirp, arg2, ret);
             }
-           free(dirp);
+           qemu_free(dirp);
         }
 #else
         {
diff --git a/migration.c b/migration.c
index 190b37e..42e3578 100644
--- a/migration.c
+++ b/migration.c
@@ -306,7 +306,7 @@ void migrate_fd_release(MigrationState *mig_state)
         s->state = MIG_STATE_CANCELLED;
         migrate_fd_cleanup(s);
     }
-    free(s);
+    qemu_free(s);
 }
 
 void migrate_fd_wait_for_unfreeze(void *opaque)
diff --git a/net.c b/net.c
index af9de73..1daa62b 100644
--- a/net.c
+++ b/net.c
@@ -214,7 +214,7 @@ int parse_host_src_port(struct sockaddr_in *haddr,
                         struct sockaddr_in *saddr,
                         const char *input_str)
 {
-    char *str = strdup(input_str);
+    char *str = qemu_strdup(input_str);
     char *host_str = str;
     char *src_str;
     const char *src_str2;
@@ -243,11 +243,11 @@ int parse_host_src_port(struct sockaddr_in *haddr,
     if (parse_host_port(saddr, src_str2) < 0)
         goto fail;
 
-    free(str);
+    qemu_free(str);
     return(0);
 
 fail:
-    free(str);
+    qemu_free(str);
     return -1;
 }
 
@@ -326,7 +326,7 @@ static char *assign_name(VLANClientState *vc1, const char 
*model)
 
     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 
-    return strdup(buf);
+    return qemu_strdup(buf);
 }
 
 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
@@ -340,9 +340,9 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 {
     VLANClientState *vc, **pvc;
     vc = qemu_mallocz(sizeof(VLANClientState));
-    vc->model = strdup(model);
+    vc->model = qemu_strdup(model);
     if (name)
-        vc->name = strdup(name);
+        vc->name = qemu_strdup(name);
     else
         vc->name = assign_name(vc, model);
     vc->can_receive = can_receive;
@@ -370,8 +370,8 @@ void qemu_del_vlan_client(VLANClientState *vc)
             if (vc->cleanup) {
                 vc->cleanup(vc);
             }
-            free(vc->name);
-            free(vc->model);
+            qemu_free(vc->name);
+            qemu_free(vc->model);
             qemu_free(vc);
             break;
         } else
@@ -1462,7 +1462,7 @@ static int net_vde_init(VLANState *vlan, const char 
*model,
     s = qemu_mallocz(sizeof(VDEState));
     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
     if (!s->vde){
-        free(s);
+        qemu_free(s);
         return -1;
     }
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
@@ -1831,8 +1831,8 @@ static int net_socket_listen_init(VLANState *vlan,
         return -1;
     }
     s->vlan = vlan;
-    s->model = strdup(model);
-    s->name = name ? strdup(name) : NULL;
+    s->model = qemu_strdup(model);
+    s->name = name ? qemu_strdup(name) : NULL;
     s->fd = fd;
     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
     return 0;
@@ -2064,7 +2064,7 @@ void qemu_check_nic_model_list(NICInfo *nd, const char * 
const *models,
     int i, exit_status = 0;
 
     if (!nd->model)
-        nd->model = strdup(default_model);
+        nd->model = qemu_strdup(default_model);
 
     if (strcmp(nd->model, "?") != 0) {
         for (i = 0 ; models[i]; i++)
@@ -2136,7 +2136,7 @@ int net_client_init(Monitor *mon, const char *device, 
const char *p)
             }
         }
         if (get_param_value(buf, sizeof(buf), "model", p)) {
-            nd->model = strdup(buf);
+            nd->model = qemu_strdup(buf);
         }
         nd->vlan = vlan;
         nd->name = name;
@@ -2193,7 +2193,7 @@ int net_client_init(Monitor *mon, const char *device, 
const char *p)
             ret = -1;
             goto out;
         }
-        vmc = malloc(sizeof(struct VMChannel));
+        vmc = qemu_malloc(sizeof(struct VMChannel));
         snprintf(name, 20, "vmchannel%ld", port);
         vmc->hd = qemu_chr_open(name, devname, NULL);
         if (!vmc->hd) {
@@ -2379,7 +2379,7 @@ void net_client_uninit(NICInfo *nd)
     nd->vlan->nb_guest_devs--;
     nb_nics--;
     nd->used = 0;
-    free((void *)nd->model);
+    qemu_free((void *)nd->model);
 }
 
 static int net_host_check_device(const char *device)
diff --git a/qemu-char.c b/qemu-char.c
index 287e0cd..455bf9b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -1559,8 +1559,8 @@ static CharDriverState *qemu_chr_open_win(const char 
*filename)
     chr->chr_close = win_chr_close;
 
     if (win_chr_init(chr, filename) < 0) {
-        free(s);
-        free(chr);
+        qemu_free(s);
+        qemu_free(chr);
         return NULL;
     }
     qemu_chr_reset(chr);
@@ -1658,8 +1658,8 @@ static CharDriverState *qemu_chr_open_win_pipe(const char 
*filename)
     chr->chr_close = win_chr_close;
 
     if (win_chr_pipe_init(chr, filename) < 0) {
-        free(s);
-        free(chr);
+        qemu_free(s);
+        qemu_free(chr);
         return NULL;
     }
     qemu_chr_reset(chr);
@@ -1814,9 +1814,9 @@ static CharDriverState *qemu_chr_open_udp(const char *def)
 
 return_err:
     if (chr)
-        free(chr);
+        qemu_free(chr);
     if (s)
-        free(s);
+        qemu_free(s);
     if (fd >= 0)
         closesocket(fd);
     return NULL;
diff --git a/qemu-img.c b/qemu-img.c
index d806cfa..ed9186d 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -787,7 +787,7 @@ static int img_convert(int argc, char **argv)
     bdrv_delete(out_bs);
     for (bs_i = 0; bs_i < bs_n; bs_i++)
         bdrv_delete(bs[bs_i]);
-    free(bs);
+    qemu_free(bs);
     return 0;
 }
 
diff --git a/qemu-io.c b/qemu-io.c
index f0a17b9..78a78e3 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -310,15 +310,15 @@ read_f(int argc, char **argv)
                return 0;
        }
 
-       if (Pflag) {
-               void* cmp_buf = malloc(pattern_count);
+       if (Pflag && pattern_count) {
+               void* cmp_buf = qemu_malloc(pattern_count);
                memset(cmp_buf, pattern, pattern_count);
                if (memcmp(buf + pattern_offset, cmp_buf, pattern_count)) {
                        printf("Pattern verification failed at offset %lld, "
                                "%d bytes\n",
                                (long long) offset + pattern_offset, 
pattern_count);
                }
-               free(cmp_buf);
+               qemu_free(cmp_buf);
        }
 
        if (qflag)
@@ -464,15 +464,15 @@ readv_f(int argc, char **argv)
                return 0;
        }
 
-       if (Pflag) {
-               void* cmp_buf = malloc(count);
+       if (Pflag && count) {
+               void* cmp_buf = qemu_malloc(count);
                memset(cmp_buf, pattern, count);
                if (memcmp(buf, cmp_buf, count)) {
                        printf("Pattern verification failed at offset %lld, "
                                "%d bytes\n",
                                (long long) offset, count);
                }
-               free(cmp_buf);
+               qemu_free(cmp_buf);
        }
 
        if (qflag)
diff --git a/readline.c b/readline.c
index 7834af0..be592ac 100644
--- a/readline.c
+++ b/readline.c
@@ -246,7 +246,7 @@ static void readline_hist_add(ReadLineState *rs, const char 
*cmdline)
     }
     if (idx == READLINE_MAX_CMDS) {
        /* Need to get one free slot */
-       free(rs->history[0]);
+       qemu_free(rs->history[0]);
        memcpy(rs->history, &rs->history[1],
               (READLINE_MAX_CMDS - 1) * sizeof(char *));
        rs->history[READLINE_MAX_CMDS - 1] = NULL;
diff --git a/slirp/socket.c b/slirp/socket.c
index 82d026c..e4d84d7 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -53,7 +53,7 @@ socreate(void)
 {
   struct socket *so;
 
-  so = (struct socket *)malloc(sizeof(struct socket));
+  so = (struct socket *)qemu_malloc(sizeof(struct socket));
   if(so) {
     memset(so, 0, sizeof(struct socket));
     so->so_state = SS_NOFDREF;
@@ -82,7 +82,7 @@ sofree(struct socket *so)
   if(so->so_next && so->so_prev)
     remque(so);  /* crashes if so is not in a queue */
 
-  free(so);
+  qemu_free(so);
 }
 
 size_t sopreprbuf(struct socket *so, struct iovec *iov, int *np)
@@ -606,13 +606,13 @@ solisten(u_int port, u_int32_t laddr, u_int lport, int 
flags)
        DEBUG_ARG("flags = %x", flags);
 
        if ((so = socreate()) == NULL) {
-         /* free(so);      Not sofree() ??? free(NULL) == NOP */
+         /* qemu_free(so);      Not sofree() ??? qemu_free(NULL) == NOP */
          return NULL;
        }
 
        /* Don't tcp_attach... we don't need so_snd nor so_rcv */
        if ((so->so_tcpcb = tcp_newtcpcb(so)) == NULL) {
-               free(so);
+               qemu_free(so);
                return NULL;
        }
        insque(so,&tcb);
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 701629a..93c39da 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -330,7 +330,7 @@ static uint32_t cpu_arm_find_by_name(const char *name)
 
 void cpu_arm_close(CPUARMState *env)
 {
-    free(env);
+    qemu_free(env);
 }
 
 uint32_t cpsr_read(CPUARMState *env)
@@ -466,7 +466,7 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong 
address, int rw,
 
 static void allocate_mmon_state(CPUState *env)
 {
-    env->mmon_entry = malloc(sizeof (mmon_state));
+    env->mmon_entry = qemu_malloc(sizeof (mmon_state));
     memset (env->mmon_entry, 0, sizeof (mmon_state));
     env->mmon_entry->cpu_env = env;
     mmon_head = env->mmon_entry;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 75e7ccd..00ff49d 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -399,11 +399,11 @@ static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, 
const char *cpu_model)
     x86_cpu_def->ext_features &= ~minus_ext_features;
     x86_cpu_def->ext2_features &= ~minus_ext2_features;
     x86_cpu_def->ext3_features &= ~minus_ext3_features;
-    free(s);
+    qemu_free(s);
     return 0;
 
 error:
-    free(s);
+    qemu_free(s);
     return -1;
 }
 
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index c4fd484..7218a24 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -229,7 +229,7 @@ static int kvm_has_msr_star(CPUState *env)
             }
         }
 
-        free(kvm_msr_list);
+        qemu_free(kvm_msr_list);
     }
 
     if (has_msr_star == 1)
diff --git a/target-ppc/kvm_ppc.c b/target-ppc/kvm_ppc.c
index 10cfdb3..acd93f6 100644
--- a/target-ppc/kvm_ppc.c
+++ b/target-ppc/kvm_ppc.c
@@ -51,7 +51,7 @@ int kvmppc_read_host_property(const char *node_path, const 
char *prop,
 close:
     fclose(f);
 free:
-    free(path);
+    qemu_free(path);
 out:
     return ret;
 }
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index 2f41418..02d1c4a 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -706,8 +706,8 @@ static int cpu_sparc_register(CPUSPARCState *env, const 
char *cpu_model)
 
 static void cpu_sparc_close(CPUSPARCState *env)
 {
-    free(env->def);
-    free(env);
+    qemu_free(env->def);
+    qemu_free(env);
 }
 
 CPUSPARCState *cpu_sparc_init(const char *cpu_model)
@@ -1333,11 +1333,11 @@ static int cpu_sparc_find_by_name(sparc_def_t *cpu_def, 
const char *cpu_model)
 #ifdef DEBUG_FEATURES
     print_features(stderr, fprintf, cpu_def->features, NULL);
 #endif
-    free(s);
+    qemu_free(s);
     return 0;
 
  error:
-    free(s);
+    qemu_free(s);
     return -1;
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 299bff6..bb3dc50 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -341,7 +341,7 @@ static inline int tcg_global_mem_new_internal(TCGType type, 
int reg,
 #endif
         pstrcpy(buf, sizeof(buf), name);
         pstrcat(buf, sizeof(buf), "_0");
-        ts->name = strdup(buf);
+        ts->name = qemu_strdup(buf);
         ts++;
 
         ts->base_type = type;
@@ -356,7 +356,7 @@ static inline int tcg_global_mem_new_internal(TCGType type, 
int reg,
 #endif
         pstrcpy(buf, sizeof(buf), name);
         pstrcat(buf, sizeof(buf), "_1");
-        ts->name = strdup(buf);
+        ts->name = qemu_strdup(buf);
 
         s->nb_globals += 2;
     } else
@@ -531,7 +531,7 @@ void tcg_register_helper(void *func, const char *name)
         } else {
             n *= 2;
         }
-        s->helpers = realloc(s->helpers, n * sizeof(TCGHelperInfo));
+        s->helpers = qemu_realloc(s->helpers, n * sizeof(TCGHelperInfo));
         s->allocated_helpers = n;
     }
     s->helpers[s->nb_helpers].func = (tcg_target_ulong)func;
diff --git a/vl.c b/vl.c
index 5e2c314..0e531f0 100644
--- a/vl.c
+++ b/vl.c
@@ -1072,7 +1072,7 @@ static void configure_alarms(char const *opt)
         exit(0);
     }
 
-    arg = strdup(opt);
+    arg = qemu_strdup(opt);
 
     /* Reorder the array */
     name = strtok(arg, ",");
@@ -1101,7 +1101,7 @@ next:
         name = strtok(NULL, ",");
     }
 
-    free(arg);
+    qemu_free(arg);
 
     if (cur) {
         /* Disable remaining timers */
@@ -4914,7 +4914,7 @@ char *qemu_find_file(int type, const char *name)
     /* If name contains path separators then try it as a straight path.  */
     if ((strchr(name, '/') || strchr(name, '\\'))
         && access(name, R_OK) == 0) {
-        return strdup(name);
+        return qemu_strdup(name);
     }
     switch (type) {
     case QEMU_FILE_TYPE_BIOS: