From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55667) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VoDY8-0002Xd-Ir for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:35:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VoDXh-0003Dk-OS for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:35:35 -0500 Received: from e31.co.us.ibm.com ([32.97.110.149]:52822) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VoDXh-0003Cv-Gi for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:35:09 -0500 Received: from /spool/local by e31.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 4 Dec 2013 07:35:09 -0700 From: Michael Roth Date: Wed, 4 Dec 2013 08:34:36 -0600 Message-Id: <1386167679-13021-30-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1386167679-13021-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1386167679-13021-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 29/32] qdev-monitor: Fix crash when device_add is called with abstract driver List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Igor Mammedov User is able to crash running QEMU when following monitor command is called: device_add intel-hda-generic Crash is caused by assertion in object_initialize_with_type() when type is abstract. Checking if type is abstract before instance is created in qdev_device_add() allows to prevent crash on incorrect user input. Cc: qemu-stable@nongnu.org Signed-off-by: Igor Mammedov Signed-off-by: Andreas Färber (cherry picked from commit 2fa4e56d88aa0039062bbc7f9a88e9f90c77ed94) Conflicts: qdev-monitor.c *updated to reflect different 1.6 variable names Signed-off-by: Michael Roth --- qdev-monitor.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/qdev-monitor.c b/qdev-monitor.c index 410cdcb..bb2e1b6 100644 --- a/qdev-monitor.c +++ b/qdev-monitor.c @@ -472,6 +472,12 @@ DeviceState *qdev_device_add(QemuOpts *opts) return NULL; } + if (object_class_is_abstract(obj)) { + qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver", + "non-abstract device type"); + return NULL; + } + k = DEVICE_CLASS(obj); /* find bus */ -- 1.7.9.5