[Qemu-devel] [PATCH] qdev: fix crash when device_add is called with abstract driver

[Qemu-devel] [PATCH] qdev: fix crash when device_add is called with abstract driver

[Igor Mammedov]

user is able to crash running QEMU when following monitor
command is called:

 device_add intel-hda-generic

crash is caused by assertion in object_initialize_with_type()
when type is abstract.

Checking if type is abstract before instance is created in
qdev_device_add() allows to prevent crash on incorrect user input.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
---
 qdev-monitor.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/qdev-monitor.c b/qdev-monitor.c
index 410cdcb..bb2e1b6 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -472,6 +472,12 @@ DeviceState *qdev_device_add(QemuOpts *opts)
         return NULL;
     }
 
+    if (object_class_is_abstract(obj)) {
+        qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver",
+                      "non-abstract device type");
+        return NULL;
+    }
+
     k = DEVICE_CLASS(obj);
 
     /* find bus */
-- 
1.7.1

Re: [Qemu-devel] [PATCH] qdev: fix crash when device_add is called with abstract driver

[Paolo Bonzini]

Il 17/09/2013 15:32, Igor Mammedov ha scritto:
> user is able to crash running QEMU when following monitor
> command is called:
> 
>  device_add intel-hda-generic
> 
> crash is caused by assertion in object_initialize_with_type()
> when type is abstract.
> 
> Checking if type is abstract before instance is created in
> qdev_device_add() allows to prevent crash on incorrect user input.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> ---
>  qdev-monitor.c |    6 ++++++
>  1 files changed, 6 insertions(+), 0 deletions(-)
> 
> diff --git a/qdev-monitor.c b/qdev-monitor.c
> index 410cdcb..bb2e1b6 100644
> --- a/qdev-monitor.c
> +++ b/qdev-monitor.c
> @@ -472,6 +472,12 @@ DeviceState *qdev_device_add(QemuOpts *opts)
>          return NULL;
>      }
>  
> +    if (object_class_is_abstract(obj)) {
> +        qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver",
> +                      "non-abstract device type");
> +        return NULL;
> +    }
> +
>      k = DEVICE_CLASS(obj);
>  
>      /* find bus */
> 

Looks good,

Paolo

Re: [Qemu-devel] [PATCH] qdev: fix crash when device_add is called with abstract driver

[Andreas Färber]

Am 17.09.2013 15:32, schrieb Igor Mammedov:
> user is able to crash running QEMU when following monitor
> command is called:
> 
>  device_add intel-hda-generic
> 
> crash is caused by assertion in object_initialize_with_type()
> when type is abstract.
> 
> Checking if type is abstract before instance is created in
> qdev_device_add() allows to prevent crash on incorrect user input.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> ---
>  qdev-monitor.c |    6 ++++++
>  1 files changed, 6 insertions(+), 0 deletions(-)

Thanks, rebased and applied to qom-next:
https://github.com/afaerber/qemu-cpu/commits/qom-next

One question though:

> 
> diff --git a/qdev-monitor.c b/qdev-monitor.c
> index 410cdcb..bb2e1b6 100644
> --- a/qdev-monitor.c
> +++ b/qdev-monitor.c
> @@ -472,6 +472,12 @@ DeviceState *qdev_device_add(QemuOpts *opts)
>          return NULL;
>      }
>  
> +    if (object_class_is_abstract(obj)) {
> +        qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver",
> +                      "non-abstract device type");

Is qerror_report() still okay despite the QERR_* considered obsolete for
error_set()? I.e. because this is only printing the text and not passing
on error classes? Or where do we draw the line? (CC Luiz)

Thanks,
Andreas

> +        return NULL;
> +    }
> +
>      k = DEVICE_CLASS(obj);
>  
>      /* find bus */

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH] qdev: fix crash when device_add is called with abstract driver

[Luiz Capitulino]

On Tue, 17 Sep 2013 19:42:08 +0200
Andreas Färber <afaerber@suse.de> wrote:

> > diff --git a/qdev-monitor.c b/qdev-monitor.c
> > index 410cdcb..bb2e1b6 100644
> > --- a/qdev-monitor.c
> > +++ b/qdev-monitor.c
> > @@ -472,6 +472,12 @@ DeviceState *qdev_device_add(QemuOpts *opts)
> >          return NULL;
> >      }
> >  
> > +    if (object_class_is_abstract(obj)) {
> > +        qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver",
> > +                      "non-abstract device type");
> 
> Is qerror_report() still okay despite the QERR_* considered obsolete for
> error_set()? I.e. because this is only printing the text and not passing
> on error classes?

This is OK because qdev_device_add() still uses qerror_report(). This is
so because do_device_add() (the QMP/HMP command in question) hasn't been
converted yet.

> Or where do we draw the line? (CC Luiz)

We should convert old qerror_report() users to error_set() whenever
doing error-related changes. But sometimes it may not be practical to do
it right away (this case).