[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/6] hw/pci: use-after-free in pci_nic_init_nofail wh
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 5/6] hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize |
Date: |
Fri, 20 Jan 2017 11:07:49 +0800 |
From: Alex Kompel <address@hidden>
object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.
(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"
Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440 in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481
Signed-off-by: Alex Kompel <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/pci/pci.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 637d545..fe9acec 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1779,7 +1779,6 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus
*rootbus,
const char *default_devaddr)
{
const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;
- Error *err = NULL;
PCIBus *bus;
PCIDevice *pci_dev;
DeviceState *dev;
@@ -1805,13 +1804,7 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus
*rootbus,
pci_dev = pci_create(bus, devfn, pci_nic_names[i]);
dev = &pci_dev->qdev;
qdev_set_nic_properties(dev, nd);
-
- object_property_set_bool(OBJECT(dev), true, "realized", &err);
- if (err) {
- error_report_err(err);
- object_unparent(OBJECT(dev));
- exit(1);
- }
+ qdev_init_nofail(dev);
return pci_dev;
}
--
2.7.4
- [Qemu-devel] [PULL 0/6] Net patches, Jason Wang, 2017/01/19
- [Qemu-devel] [PULL 1/6] docs: Fix description of the sentence, Jason Wang, 2017/01/19
- [Qemu-devel] [PULL 2/6] net: optimize checksum computation, Jason Wang, 2017/01/19
- [Qemu-devel] [PULL 3/6] m68k: QOMify the MCF Fast Ethernet Controller device, Jason Wang, 2017/01/19
- [Qemu-devel] [PULL 5/6] hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize,
Jason Wang <=
- [Qemu-devel] [PULL 4/6] hw/net/dp8393x: Avoid unintentional sign extensions on addresses, Jason Wang, 2017/01/19
- [Qemu-devel] [PULL 6/6] tap: fix memory leak on failure in net_init_tap(), Jason Wang, 2017/01/19
- Re: [Qemu-devel] [PULL 0/6] Net patches, Peter Maydell, 2017/01/20