[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 06/23] qdev: fix use-after-free in the error path of
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 06/23] qdev: fix use-after-free in the error path of qdev_init_nofail |
Date: |
Tue, 21 Aug 2012 12:05:40 -0500 |
From: Anthony Liguori <address@hidden>
>From Markus:
Before:
$ qemu-system-x86_64 -display none -drive if=ide
qemu-system-x86_64: Device needs media, but drive is empty
qemu-system-x86_64: Initialization of device ide-hd failed
[Exit 1 ]
After:
$ qemu-system-x86_64 -display none -drive if=ide
qemu-system-x86_64: Device needs media, but drive is empty
Segmentation fault (core dumped)
[Exit 139 (SIGSEGV)]
This error always existed as qdev_init() frees the object. But QOM
goes a bit further and purposefully sets the class pointer to NULL to
help find use-after-free. It worked :-)
Cc: Andreas Faerber <address@hidden>
Reported-by: Markus Armbruster <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 7de3abe505e34398cef5bddf6c4d0bd9ee47007f)
Signed-off-by: Michael Roth <address@hidden>
---
hw/qdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/qdev.c b/hw/qdev.c
index af419b9..8e8ca3f 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -256,9 +256,10 @@ int qdev_simple_unplug_cb(DeviceState *dev)
way is somewhat unclean, and best avoided. */
void qdev_init_nofail(DeviceState *dev)
{
+ const char *typename = object_get_typename(OBJECT(dev));
+
if (qdev_init(dev) < 0) {
- error_report("Initialization of device %s failed",
- object_get_typename(OBJECT(dev)));
+ error_report("Initialization of device %s failed", typename);
exit(1);
}
}
--
1.7.9.5
- [Qemu-devel] [stable-1.1] Patch Round-up for stable 1.1.2, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 02/23] configure: Don't override user's --cpu on MacOS and Solaris, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 03/23] ppc: Fix bug in handling of PAPR hypercall exits, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 05/23] kvmvapic: Disable if there is insufficient memory, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 04/23] s390: Fix error handling and condition code of service call, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 01/23] qtest: fix infinite loop when QEMU aborts abruptly, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 07/23] virtio-blk: fix use-after-free while handling scsi commands, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 08/23] ehci: fix reset, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 06/23] qdev: fix use-after-free in the error path of qdev_init_nofail,
Michael Roth <=
- [Qemu-devel] [PATCH 13/23] usb-ehci: Fix an assert whenever isoc transfers are used, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 11/23] usb: restore USBDevice->attached on vmload, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 10/23] uhci: fix uhci_async_cancel_all, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 14/23] qlist: add qlist_size(), Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 09/23] ehci: don't flush cache on doorbell rings., Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 12/23] usb-redir: Correctly handle the usb_redir_babble usbredir status, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 16/23] check-qjson: add test for large JSON objects, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 17/23] slirp: Enforce host-side user of smb share, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 15/23] json-parser: don't replicate tokens at each level of recursion, Michael Roth, 2012/08/21
- [Qemu-devel] [PATCH 19/23] slirp: Improve error reporting of inaccessible smb directories, Michael Roth, 2012/08/21