[Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1

[Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1

[Alex Williamson]

The following changes since commit 522fd24ca030c27c591dafedd65c1dfd51e40450:

  Update version for v2.10.0-rc0 release (2017-07-25 17:13:09 +0100)

are available in the git repository at:

  git://github.com/awilliam/qemu-vfio.git tags/vfio-fixes-20170726.0

for you to fetch changes up to 96d2c2c57452f8b6bc3decae71435e7230f3432e:

  vfio/pci: fix use of freed memory (2017-07-26 11:38:18 -0600)

----------------------------------------------------------------
VFIO fixes 2017-07-26

 - Error path use after free bug fixes (Philippe Mathieu-Daudé)

----------------------------------------------------------------
Philippe Mathieu-Daudé (2):
      vfio/platform: fix use of freed memory
      vfio/pci: fix use of freed memory

 hw/vfio/pci.c      | 11 +++++++----
 hw/vfio/platform.c |  2 +-
 2 files changed, 8 insertions(+), 5 deletions(-)

[Qemu-devel] [PULL 1/2] vfio/platform: fix use of freed memory

[Alex Williamson]

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

free the data _after_ using it.

hw/vfio/platform.c:126:29: warning: Use of memory after it is freed
        qemu_set_fd_handler(*pfd, NULL, NULL, NULL);
                            ^~~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
 hw/vfio/platform.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 7c09deda6143..da84abf4fc4c 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -120,11 +120,11 @@ static int vfio_set_trigger_eventfd(VFIOINTp *intp,
     *pfd = event_notifier_get_fd(intp->interrupt);
     qemu_set_fd_handler(*pfd, (IOHandler *)handler, NULL, intp);
     ret = ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
-    g_free(irq_set);
     if (ret < 0) {
         error_report("vfio: Failed to set trigger eventfd: %m");
         qemu_set_fd_handler(*pfd, NULL, NULL, NULL);
     }
+    g_free(irq_set);
     return ret;
 }
 

[Qemu-devel] [PULL 2/2] vfio/pci: fix use of freed memory

[Alex Williamson]

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

hw/vfio/pci.c:308:29: warning: Use of memory after it is freed
        qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
                            ^~~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
 hw/vfio/pci.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index d4051cb9513d..31e1edf44745 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -257,7 +257,7 @@ static void vfio_intx_update(PCIDevice *pdev)
 static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
 {
     uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1);
-    int ret, argsz;
+    int ret, argsz, retval = 0;
     struct vfio_irq_set *irq_set;
     int32_t *pfd;
     Error *err = NULL;
@@ -302,12 +302,12 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     qemu_set_fd_handler(*pfd, vfio_intx_interrupt, NULL, vdev);
 
     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
-    g_free(irq_set);
     if (ret) {
         error_setg_errno(errp, -ret, "failed to setup INTx fd");
         qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
         event_notifier_cleanup(&vdev->intx.interrupt);
-        return -errno;
+        retval = -errno;
+        goto cleanup;
     }
 
     vfio_intx_enable_kvm(vdev, &err);
@@ -319,7 +319,10 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
 
     trace_vfio_intx_enable(vdev->vbasedev.name);
 
-    return 0;
+cleanup:
+    g_free(irq_set);
+
+    return retval;
 }
 
 static void vfio_intx_disable(VFIOPCIDevice *vdev)

Re: [Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1

[Peter Maydell]

On 26 July 2017 at 19:45, Alex Williamson <alex.williamson@redhat.com> wrote:
> The following changes since commit 522fd24ca030c27c591dafedd65c1dfd51e40450:
>
>   Update version for v2.10.0-rc0 release (2017-07-25 17:13:09 +0100)
>
> are available in the git repository at:
>
>   git://github.com/awilliam/qemu-vfio.git tags/vfio-fixes-20170726.0
>
> for you to fetch changes up to 96d2c2c57452f8b6bc3decae71435e7230f3432e:
>
>   vfio/pci: fix use of freed memory (2017-07-26 11:38:18 -0600)
>
> ----------------------------------------------------------------
> VFIO fixes 2017-07-26
>
>  - Error path use after free bug fixes (Philippe Mathieu-Daudé)
>
> ----------------------------------------------------------------
> Philippe Mathieu-Daudé (2):
>       vfio/platform: fix use of freed memory
>       vfio/pci: fix use of freed memory

Applied, thanks.

-- PMM