diff options
author | Markus Armbruster <armbru@redhat.com> | 2023-04-03 16:12:30 +0100 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2023-04-03 16:12:30 +0100 |
commit | 12148d442ec3f4386c8624ffcf44c61a8b344018 (patch) | |
tree | c976557356f206de2a7c3cdf7db1371e62f8747c /hw/arm | |
parent | b15bdc965106a10dbac2e50dc598ee7fd926ff14 (diff) | |
download | qemu-12148d442ec3f4386c8624ffcf44c61a8b344018.zip qemu-12148d442ec3f4386c8624ffcf44c61a8b344018.tar.gz qemu-12148d442ec3f4386c8624ffcf44c61a8b344018.tar.bz2 |
hw/arm: do not free machine->fdt in arm_load_dtb()
At this moment, arm_load_dtb() can free machine->fdt when
binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be
retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is
the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to
machine->fdt. And, in that case, the existing g_free(fdt) at the end of
arm_load_dtb() will make machine->fdt point to an invalid memory region.
Since monitor command 'dumpdtb' was introduced a couple of releases
ago, running it with any ARM machine that uses arm_load_dtb() will
crash QEMU.
Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead
of freeing 'fdt', assign it back to ms->fdt.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb")
Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-id: 20230328165935.1512846-1-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/arm')
-rw-r--r-- | hw/arm/boot.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/hw/arm/boot.c b/hw/arm/boot.c index 50e5141..54f6a3e 100644 --- a/hw/arm/boot.c +++ b/hw/arm/boot.c @@ -689,7 +689,10 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo, qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds, rom_ptr_for_as(as, addr, size)); - g_free(fdt); + if (fdt != ms->fdt) { + g_free(ms->fdt); + ms->fdt = fdt; + } return size; |