Re: [Qemu-devel] Use-after-free during unrealize in system_reset

[Bandan Das <bsd@redhat.com>]

Paolo Bonzini <pbonzini@redhat.com> writes:

> Il 08/06/2014 12:46, Michael S. Tsirkin ha scritto:
>> Tested-by: Michael S. Tsirkin <mst@redhat.com>
>
> You probably tested the reversal, actually. :)
>
> Actually, there is a reason for it.  "Unassembling" the device
> (unparent) should come after "powering it down" (unrealize).

Yes, exactly. But to be honest, I was not sure if I was doing the 
right thing and hence posted this series as a RFC.

> However, the bus is missing a recursive unrealization of the devices
> below it prior to calling bc->unrealize:
>
> diff --git a/hw/core/qdev.c b/hw/core/qdev.c
> index e65a5aa..4282491 100644
> --- a/hw/core/qdev.c
> +++ b/hw/core/qdev.c
> @@ -567,32 +567,35 @@ static void bus_set_realized(Object *obj, bool
> value, Error **errp)
>  {
>      BusState *bus = BUS(obj);
>      BusClass *bc = BUS_GET_CLASS(bus);
> +    BusChild *kid;
>      Error *local_err = NULL;
>
>      if (value && !bus->realized) {
>          if (bc->realize) {
>              bc->realize(bus, &local_err);
> -
> -            if (local_err != NULL) {
> -                goto error;
> -            }
> -
>          }
> +
> +        /* TODO: recursive realization */
>      } else if (!value && bus->realized) {
> -        if (bc->unrealize) {
> +        QTAILQ_FOREACH(kid, &bus->children, sibling) {
> +            DeviceState *dev = kid->child;
> +            object_property_set_bool(OBJECT(dev), false, "realized",
> +                                     &local_err);
> +            if (local_err != NULL) {
> +                break;
> +            }
> +        }
> +        if (bc->unrealize && local_err == NULL) {
>              bc->unrealize(bus, &local_err);

It also seems that my original patch included unrealizing children, but
that didn't get in for some reason -
https://lists.gnu.org/archive/html/qemu-devel/2013-11/msg03204.html
Andreas might have had a reason not to include it however..

> -
> -            if (local_err != NULL) {
> -                goto error;
> -            }
>          }
>      }
>
> +    if (local_err != NULL) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
>      bus->realized = value;
> -    return;
> -
> -error:
> -    error_propagate(errp, local_err);
>  }
>
>  void qbus_create_inplace(void *bus, size_t size, const char *typename,
>
>
> This seems to fix the bug too.
>
> Paolo