From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36415) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xljl0-00022e-LV for qemu-devel@nongnu.org; Tue, 04 Nov 2014 14:27:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xljkl-00080J-FT for qemu-devel@nongnu.org; Tue, 04 Nov 2014 14:27:10 -0500 From: Alexander Graf Date: Tue, 4 Nov 2014 20:26:33 +0100 Message-Id: <1415129211-9740-16-git-send-email-agraf@suse.de> In-Reply-To: <1415129211-9740-1-git-send-email-agraf@suse.de> References: <1415129211-9740-1-git-send-email-agraf@suse.de> Subject: [Qemu-devel] [PULL 15/33] target-ppc: Fix an invalid free in opcode table handling code. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-ppc@nongnu.org Cc: peter.maydell@linaro.org, qemu-devel@nongnu.org, Bharata B Rao From: Bharata B Rao Opcode table has direct, indirect and double indirect handlers, but ppc_cpu_unrealizefn() frees direct handlers which are never allocated and never frees double indirect handlers. Signed-off-by: Bharata B Rao Signed-off-by: Alexander Graf --- target-ppc/translate_init.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c index 3ff68ae..20d58c0 100644 --- a/target-ppc/translate_init.c +++ b/target-ppc/translate_init.c @@ -9132,11 +9132,24 @@ static void ppc_cpu_unrealizefn(DeviceState *dev, Error **errp) { PowerPCCPU *cpu = POWERPC_CPU(dev); CPUPPCState *env = &cpu->env; - int i; + opc_handler_t **table; + int i, j; for (i = 0; i < PPC_CPU_OPCODES_LEN; i++) { - if (env->opcodes[i] != &invalid_handler) { - g_free(env->opcodes[i]); + if (env->opcodes[i] == &invalid_handler) { + continue; + } + if (is_indirect_opcode(env->opcodes[i])) { + table = ind_table(env->opcodes[i]); + for (j = 0; j < PPC_CPU_INDIRECT_OPCODES_LEN; j++) { + if (table[j] != &invalid_handler && + is_indirect_opcode(table[j])) { + g_free((opc_handler_t *)((uintptr_t)table[j] & + ~PPC_INDIRECT)); + } + } + g_free((opc_handler_t *)((uintptr_t)env->opcodes[i] & + ~PPC_INDIRECT)); } } } -- 1.8.1.4