* Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()
2017-08-02 17:34 [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load() Greg Kurz
@ 2017-08-02 17:49 ` Eric Blake
2017-08-02 18:43 ` Philippe Mathieu-Daudé
2017-08-03 1:37 ` David Gibson
2 siblings, 0 replies; 4+ messages in thread
From: Eric Blake @ 2017-08-02 17:49 UTC (permalink / raw)
To: Greg Kurz, qemu-devel; +Cc: qemu-ppc, David Gibson
[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]
On 08/02/2017 12:34 PM, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
>
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
> target/ppc/machine.c | 1 -
> 1 file changed, 1 deletion(-)
Reviewed-by: Eric Blake <eblake@redhat.com>
>
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
> ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
> if (local_err) {
> error_report_err(local_err);
> - error_free(local_err);
> return -1;
> }
> } else
>
>
>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 619 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()
2017-08-02 17:34 [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load() Greg Kurz
2017-08-02 17:49 ` Eric Blake
@ 2017-08-02 18:43 ` Philippe Mathieu-Daudé
2017-08-03 1:37 ` David Gibson
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2017-08-02 18:43 UTC (permalink / raw)
To: Greg Kurz, qemu-devel; +Cc: qemu-ppc, David Gibson
On 08/02/2017 02:34 PM, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
>
> Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> target/ppc/machine.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
> ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
> if (local_err) {
> error_report_err(local_err);
> - error_free(local_err);
> return -1;
> }
> } else
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()
2017-08-02 17:34 [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load() Greg Kurz
2017-08-02 17:49 ` Eric Blake
2017-08-02 18:43 ` Philippe Mathieu-Daudé
@ 2017-08-03 1:37 ` David Gibson
2 siblings, 0 replies; 4+ messages in thread
From: David Gibson @ 2017-08-03 1:37 UTC (permalink / raw)
To: Greg Kurz; +Cc: qemu-devel, qemu-ppc
[-- Attachment #1: Type: text/plain, Size: 1131 bytes --]
On Wed, Aug 02, 2017 at 07:34:16PM +0200, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
>
> Signed-off-by: Greg Kurz <groug@kaod.org>
Oops, that's a bit embarassing. Applied to ppc-for-2.10.
> ---
> target/ppc/machine.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
> ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
> if (local_err) {
> error_report_err(local_err);
> - error_free(local_err);
> return -1;
> }
> } else
>
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread