From 7de3abe505e34398cef5bddf6c4d0bd9ee47007f Mon Sep 17 00:00:00 2001 From: Anthony Liguori Date: Wed, 27 Jun 2012 07:37:54 -0500 Subject: [PATCH] qdev: fix use-after-free in the error path of qdev_init_nofail From Markus: Before: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty qemu-system-x86_64: Initialization of device ide-hd failed [Exit 1 ] After: $ qemu-system-x86_64 -display none -drive if=ide qemu-system-x86_64: Device needs media, but drive is empty Segmentation fault (core dumped) [Exit 139 (SIGSEGV)] This error always existed as qdev_init() frees the object. But QOM goes a bit further and purposefully sets the class pointer to NULL to help find use-after-free. It worked :-) Cc: Andreas Faerber Reported-by: Markus Armbruster Signed-off-by: Anthony Liguori --- hw/qdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index a6c4c02947..af544675bf 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -258,9 +258,10 @@ int qdev_simple_unplug_cb(DeviceState *dev) way is somewhat unclean, and best avoided. */ void qdev_init_nofail(DeviceState *dev) { + const char *typename = object_get_typename(OBJECT(dev)); + if (qdev_init(dev) < 0) { - error_report("Initialization of device %s failed", - object_get_typename(OBJECT(dev))); + error_report("Initialization of device %s failed", typename); exit(1); } } -- GitLab