From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:35309) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1UPD-0004uC-D8 for qemu-devel@nongnu.org; Wed, 06 Mar 2019 06:08:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h1UPB-00029N-AK for qemu-devel@nongnu.org; Wed, 06 Mar 2019 06:08:11 -0500 From: Laurent Vivier Date: Wed, 6 Mar 2019 12:07:06 +0100 Message-Id: <20190306110711.309-6-laurent@vivier.eu> In-Reply-To: <20190306110711.309-1-laurent@vivier.eu> References: <20190306110711.309-1-laurent@vivier.eu> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PULL 05/10] block/pflash_cfi02: Fix memory leak and potential use-after-free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Riku Voipio , Zhang Chen , zhanghailiang , Christian Borntraeger , Cornelia Huck , Kevin Wolf , Richard Henderson , Thomas Huth , Igor Mammedov , Li Zhijian , John Snow , Halil Pasic , Pavel Dovgalyuk , Laurent Vivier , Eduardo Habkost , qemu-block@nongnu.org, Marcel Apfelbaum , Tony Krowiak , Max Reitz , "Michael S. Tsirkin" , qemu-trivial@nongnu.org, Laurent Vivier , Michael Tokarev , qemu-s390x@nongnu.org, Corey Minyard , Pierre Morel , Stephen Checkoway , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Wei Yang From: Stephen Checkoway Don't dynamically allocate the pflash's timer. But do use timer_del in an unrealize function to make sure that the timer can't fire after the pflash_t has been freed. Signed-off-by: Stephen Checkoway Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Wei Yang Message-Id: <20190219153727.62279-1-stephen.checkoway@oberlin.edu> Signed-off-by: Laurent Vivier --- hw/block/pflash_cfi02.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c index 0f8b7b8c7b36..1588aeff5a95 100644 --- a/hw/block/pflash_cfi02.c +++ b/hw/block/pflash_cfi02.c @@ -84,7 +84,7 @@ struct pflash_t { uint16_t unlock_addr0; uint16_t unlock_addr1; uint8_t cfi_table[0x52]; - QEMUTimer *timer; + QEMUTimer timer; /* The device replicates the flash memory across its memory space. Emulate * that by having a container (.mem) filled with an array of aliases * (.mem_mappings) pointing to the flash memory (.orig_mem). @@ -429,7 +429,7 @@ static void pflash_write (pflash_t *pfl, hwaddr offset, } pfl->status = 0x00; /* Let's wait 5 seconds before chip erase is done */ - timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + + timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + (NANOSECONDS_PER_SECOND * 5)); break; case 0x30: @@ -444,7 +444,7 @@ static void pflash_write (pflash_t *pfl, hwaddr offset, } pfl->status = 0x00; /* Let's wait 1/2 second before sector erase is done */ - timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + + timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + (NANOSECONDS_PER_SECOND / 2)); break; default: @@ -596,7 +596,7 @@ static void pflash_cfi02_realize(DeviceState *dev, Error **errp) pfl->rom_mode = 1; sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem); - pfl->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); + timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); pfl->wcycle = 0; pfl->cmd = 0; pfl->status = 0; @@ -695,11 +695,18 @@ static Property pflash_cfi02_properties[] = { DEFINE_PROP_END_OF_LIST(), }; +static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp) +{ + pflash_t *pfl = CFI_PFLASH02(dev); + timer_del(&pfl->timer); +} + static void pflash_cfi02_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->realize = pflash_cfi02_realize; + dc->unrealize = pflash_cfi02_unrealize; dc->props = pflash_cfi02_properties; set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); } -- 2.20.1