* [Qemu-devel] [PULL 1/2] vfio/platform: fix use of freed memory
2017-07-26 18:45 [Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1 Alex Williamson
@ 2017-07-26 18:45 ` Alex Williamson
2017-07-26 18:45 ` [Qemu-devel] [PULL 2/2] vfio/pci: " Alex Williamson
2017-07-27 10:29 ` [Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1 Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Alex Williamson @ 2017-07-26 18:45 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
free the data _after_ using it.
hw/vfio/platform.c:126:29: warning: Use of memory after it is freed
qemu_set_fd_handler(*pfd, NULL, NULL, NULL);
^~~~
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
hw/vfio/platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 7c09deda6143..da84abf4fc4c 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -120,11 +120,11 @@ static int vfio_set_trigger_eventfd(VFIOINTp *intp,
*pfd = event_notifier_get_fd(intp->interrupt);
qemu_set_fd_handler(*pfd, (IOHandler *)handler, NULL, intp);
ret = ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
- g_free(irq_set);
if (ret < 0) {
error_report("vfio: Failed to set trigger eventfd: %m");
qemu_set_fd_handler(*pfd, NULL, NULL, NULL);
}
+ g_free(irq_set);
return ret;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread* [Qemu-devel] [PULL 2/2] vfio/pci: fix use of freed memory
2017-07-26 18:45 [Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1 Alex Williamson
2017-07-26 18:45 ` [Qemu-devel] [PULL 1/2] vfio/platform: fix use of freed memory Alex Williamson
@ 2017-07-26 18:45 ` Alex Williamson
2017-07-27 10:29 ` [Qemu-devel] [PULL 0/2] VFIO fixes for v2.10-rc1 Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Alex Williamson @ 2017-07-26 18:45 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
hw/vfio/pci.c:308:29: warning: Use of memory after it is freed
qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
^~~~
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
hw/vfio/pci.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index d4051cb9513d..31e1edf44745 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -257,7 +257,7 @@ static void vfio_intx_update(PCIDevice *pdev)
static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
{
uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1);
- int ret, argsz;
+ int ret, argsz, retval = 0;
struct vfio_irq_set *irq_set;
int32_t *pfd;
Error *err = NULL;
@@ -302,12 +302,12 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
qemu_set_fd_handler(*pfd, vfio_intx_interrupt, NULL, vdev);
ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
- g_free(irq_set);
if (ret) {
error_setg_errno(errp, -ret, "failed to setup INTx fd");
qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
event_notifier_cleanup(&vdev->intx.interrupt);
- return -errno;
+ retval = -errno;
+ goto cleanup;
}
vfio_intx_enable_kvm(vdev, &err);
@@ -319,7 +319,10 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
trace_vfio_intx_enable(vdev->vbasedev.name);
- return 0;
+cleanup:
+ g_free(irq_set);
+
+ return retval;
}
static void vfio_intx_disable(VFIOPCIDevice *vdev)
^ permalink raw reply related [flat|nested] 4+ messages in thread