* [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize
@ 2021-11-17 14:23 Daniil Tatianin
2021-11-17 14:51 ` Marc-André Lureau
0 siblings, 1 reply; 3+ messages in thread
From: Daniil Tatianin @ 2021-11-17 14:23 UTC (permalink / raw)
To: qemu-devel; +Cc: marcandre.lureau, yc-core, pbonzini
Object is supposed to be freed by invoking obj->free, and not
obj->instance_finalize. This would lead to use-after-free followed by
double free in object_unref/object_finalize.
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
---
chardev/wctablet.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index e9cb7ca710..fa3c9be04e 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -318,7 +318,6 @@ static void wctablet_chr_finalize(Object *obj)
TabletChardev *tablet = WCTABLET_CHARDEV(obj);
qemu_input_handler_unregister(tablet->hs);
- g_free(tablet);
}
static void wctablet_chr_open(Chardev *chr,
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize
2021-11-17 14:23 [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize Daniil Tatianin
@ 2021-11-17 14:51 ` Marc-André Lureau
2021-11-19 9:24 ` Paolo Bonzini
0 siblings, 1 reply; 3+ messages in thread
From: Marc-André Lureau @ 2021-11-17 14:51 UTC (permalink / raw)
To: Daniil Tatianin; +Cc: Bonzini, Paolo, qemu-devel, yc-core, qemu-stable
Hi
On Wed, Nov 17, 2021 at 6:25 PM Daniil Tatianin
<d-tatianin@yandex-team.ru> wrote:
>
> Object is supposed to be freed by invoking obj->free, and not
> obj->instance_finalize. This would lead to use-after-free followed by
> double free in object_unref/object_finalize.
>
> Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Fixes: 378af96155d62 ("Add wctablet device")
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> chardev/wctablet.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/chardev/wctablet.c b/chardev/wctablet.c
> index e9cb7ca710..fa3c9be04e 100644
> --- a/chardev/wctablet.c
> +++ b/chardev/wctablet.c
> @@ -318,7 +318,6 @@ static void wctablet_chr_finalize(Object *obj)
> TabletChardev *tablet = WCTABLET_CHARDEV(obj);
>
> qemu_input_handler_unregister(tablet->hs);
> - g_free(tablet);
> }
>
> static void wctablet_chr_open(Chardev *chr,
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize
2021-11-17 14:51 ` Marc-André Lureau
@ 2021-11-19 9:24 ` Paolo Bonzini
0 siblings, 0 replies; 3+ messages in thread
From: Paolo Bonzini @ 2021-11-19 9:24 UTC (permalink / raw)
To: Marc-André Lureau, Daniil Tatianin; +Cc: qemu-devel, yc-core, qemu-stable
On 11/17/21 15:51, Marc-André Lureau wrote:
> Hi
>
> On Wed, Nov 17, 2021 at 6:25 PM Daniil Tatianin
> <d-tatianin@yandex-team.ru> wrote:
>>
>> Object is supposed to be freed by invoking obj->free, and not
>> obj->instance_finalize. This would lead to use-after-free followed by
>> double free in object_unref/object_finalize.
>>
>> Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
>
> Fixes: 378af96155d62 ("Add wctablet device")
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>
>> ---
>> chardev/wctablet.c | 1 -
>> 1 file changed, 1 deletion(-)
>>
>> diff --git a/chardev/wctablet.c b/chardev/wctablet.c
>> index e9cb7ca710..fa3c9be04e 100644
>> --- a/chardev/wctablet.c
>> +++ b/chardev/wctablet.c
>> @@ -318,7 +318,6 @@ static void wctablet_chr_finalize(Object *obj)
>> TabletChardev *tablet = WCTABLET_CHARDEV(obj);
>>
>> qemu_input_handler_unregister(tablet->hs);
>> - g_free(tablet);
>> }
>>
>> static void wctablet_chr_open(Chardev *chr,
>> --
>> 2.25.1
>>
>
>
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-11-19 9:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-11-17 14:23 [PATCH v1] chardev/wctable: don't free the instance in wctablet_chr_finalize Daniil Tatianin
2021-11-17 14:51 ` Marc-André Lureau
2021-11-19 9:24 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).