Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu
切换分支/标签
  1. 05 10月, 2012 1 次提交
  3. 24 8月, 2012 1 次提交
    • P
      qom: object_delete should unparent the object first · da5a44e8
      由 Paolo Bonzini 提交于 
      object_deinit is only called when the reference count goes to zero,
and yet tries to do an object_unparent.  Now, object_unparent
either does nothing or it will decrease the reference count.
Because we know the reference count is zero, the object_unparent
call in object_deinit is useless.

Instead, we need to disconnect the object from its parent just
before we remove the last reference apart from the parent's.  This
happens in object_delete.  Once we do this, all calls to
object_unparent peppered through QEMU can go away.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      da5a44e8
  5. 01 8月, 2012 1 次提交
  7. 28 6月, 2012 1 次提交
    • A
      qdev: fix use-after-free in the error path of qdev_init_nofail · 7de3abe5
      由 Anthony Liguori 提交于 
      From Markus:

Before:

    $ qemu-system-x86_64 -display none -drive if=ide
    qemu-system-x86_64: Device needs media, but drive is empty
    qemu-system-x86_64: Initialization of device ide-hd failed
    [Exit 1 ]

After:

    $ qemu-system-x86_64 -display none -drive if=ide
    qemu-system-x86_64: Device needs media, but drive is empty
    Segmentation fault (core dumped)
    [Exit 139 (SIGSEGV)]

This error always existed as qdev_init() frees the object.  But QOM
goes a bit further and purposefully sets the class pointer to NULL to
help find use-after-free.  It worked :-)

Cc: Andreas Faerber <afaerber@suse.de>
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      7de3abe5
  9. 18 6月, 2012 12 次提交
  11. 12 6月, 2012 1 次提交
    • J
      qdev: release parent properties on dc->init failure · 266ca11a
      由 Jason Baron 提交于 
      While looking into hot-plugging bridges, I can create a qemu segfault via:

$ device_add pci-bridge

Bridge chassis not specified. Each bridge is required to be assigned a unique chassis id > 0.
**
ERROR:qom/object.c:389:object_delete: assertion failed: (obj->ref == 0)

I'm proposing to fix this by adding a call to 'object_unparent()', before the
call to qdev_free(). I see there is already a precedent for this usage pattern as
seen in qdev_simple_unplug_cb():

/* can be used as ->unplug() callback for the simple cases */
int qdev_simple_unplug_cb(DeviceState *dev)
{
    /* just zap it */
    object_unparent(OBJECT(dev));
    qdev_free(dev);
    return 0;
}
Signed-off-by: NJason Baron <jbaron@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
      266ca11a
  13. 12 5月, 2012 1 次提交
  15. 24 4月, 2012 1 次提交
  17. 10 4月, 2012 1 次提交
    • L
      qdev: qdev_unplug(): use error_set() · 56f9107e
      由 Luiz Capitulino 提交于 
      It currently uses qerror_report(), but next commit will convert
the drive_del command to the QAPI and this requires using
error_set().

One particularity of qerror_report() is that it knows when it's
running on monitor context or command-line context and prints the
error message accordingly. error_set() doesn't do this, so we
have to be careful not to drop error messages.

qdev_unplug() has three kinds of usages:

 1. It's called when hot adding a device fails, to undo anything
    that has been done before hitting the error

 2. It's called by function monitor functions like device_del(),
    to unplug a device

 3. It's used by xen_platform.c in a way that doesn't _seem_ to
    be in monitor context

Only item 2 can print an error message to the user, this commit
maintains that.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
      56f9107e
  19. 03 4月, 2012 2 次提交
  21. 17 2月, 2012 1 次提交
    • A
      qdev: Fix qdev_try_create() semantics · 4ed658ca
      由 Andreas Färber 提交于 
      Since QOM'ification, qdev_try_create() uses object_new() internally,
which asserts "type != NULL" when the type is not registered.
This was revealed by the combination of kvmclock's kvm_enabled() check
and early QOM type registration.

Check whether the class exists before calling object_new(), so that
the caller (e.g., qdev_create) can fail gracefully, telling us which
device could not be created.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Cc: Anthony Liguori <aliguori@codemonkey.ws>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      4ed658ca
  23. 15 2月, 2012 1 次提交
  25. 07 2月, 2012 4 次提交
  27. 04 2月, 2012 12 次提交