From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:45466) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T3ruV-0007Gw-C5 for qemu-devel@nongnu.org; Tue, 21 Aug 2012 13:06:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T3ruO-0002hy-Dc for qemu-devel@nongnu.org; Tue, 21 Aug 2012 13:06:35 -0400 Received: from mail-gg0-f173.google.com ([209.85.161.173]:58041) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T3ruO-0002fG-9T for qemu-devel@nongnu.org; Tue, 21 Aug 2012 13:06:28 -0400 Received: by mail-gg0-f173.google.com with SMTP id a5so32818ggn.4 for ; Tue, 21 Aug 2012 10:06:28 -0700 (PDT) Sender: fluxion From: Michael Roth Date: Tue, 21 Aug 2012 12:05:40 -0500 Message-Id: <1345568757-14365-7-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1345568757-14365-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1345568757-14365-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 06/23] qdev: fix use-after-free in the error path of qdev_init_nofail List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@us.ibm.com From: Anthony Liguori >>From Markus: Before: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty qemu-system-x86_64: Initialization of device ide-hd failed [Exit 1 ] After: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty Segmentation fault (core dumped) [Exit 139 (SIGSEGV)] This error always existed as qdev_init() frees the object. But QOM goes a bit further and purposefully sets the class pointer to NULL to help find use-after-free. It worked :-) Cc: Andreas Faerber Reported-by: Markus Armbruster Signed-off-by: Anthony Liguori (cherry picked from commit 7de3abe505e34398cef5bddf6c4d0bd9ee47007f) Signed-off-by: Michael Roth --- hw/qdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index af419b9..8e8ca3f 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -256,9 +256,10 @@ int qdev_simple_unplug_cb(DeviceState *dev) way is somewhat unclean, and best avoided. */ void qdev_init_nofail(DeviceState *dev) { + const char *typename = object_get_typename(OBJECT(dev)); + if (qdev_init(dev) < 0) { - error_report("Initialization of device %s failed", - object_get_typename(OBJECT(dev))); + error_report("Initialization of device %s failed", typename); exit(1); } } -- 1.7.9.5