qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_


From: Paolo Bonzini
Subject: Re: [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize
Date: Fri, 19 Nov 2021 10:24:58 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0

On 11/17/21 15:51, Marc-André Lureau wrote:
Hi

On Wed, Nov 17, 2021 at 6:25 PM Daniil Tatianin
<d-tatianin@yandex-team.ru> wrote:

Object is supposed to be freed by invoking obj->free, and not
obj->instance_finalize. This would lead to use-after-free followed by
double free in object_unref/object_finalize.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>

Fixes: 378af96155d62 ("Add wctablet device")

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

---
  chardev/wctablet.c | 1 -
  1 file changed, 1 deletion(-)

diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index e9cb7ca710..fa3c9be04e 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -318,7 +318,6 @@ static void wctablet_chr_finalize(Object *obj)
      TabletChardev *tablet = WCTABLET_CHARDEV(obj);

      qemu_input_handler_unregister(tablet->hs);
-    g_free(tablet);
  }

  static void wctablet_chr_open(Chardev *chr,
--
2.25.1




Queued, thanks.

Paolo




reply via email to

[Prev in Thread] Current Thread [Next in Thread]