diff options
| author | Alex Kompel <barbos@gmail.com> | 2017-01-06 15:48:27 -0800 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2017-01-20 10:58:26 +0800 |
| commit | a023b7ac6262106e9a7d248bb61ec928fbf94896 (patch) | |
| tree | 8a8018dc688500a9aa5f08cdd24720782444c573 /hw/pci | |
| parent | 581f7b127dfe9ed10ce3216e440cc5be1582911b (diff) | |
| download | qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.zip qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.tar.gz qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.tar.bz2 | |
hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.
(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"
Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440 in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481
Signed-off-by: Alex Kompel <barbos@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/pci')
| -rw-r--r-- | hw/pci/pci.c | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/hw/pci/pci.c b/hw/pci/pci.c index 637d545..fe9acec 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -1779,7 +1779,6 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus, const char *default_devaddr) { const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr; - Error *err = NULL; PCIBus *bus; PCIDevice *pci_dev; DeviceState *dev; @@ -1805,13 +1804,7 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus, pci_dev = pci_create(bus, devfn, pci_nic_names[i]); dev = &pci_dev->qdev; qdev_set_nic_properties(dev, nd); - - object_property_set_bool(OBJECT(dev), true, "realized", &err); - if (err) { - error_report_err(err); - object_unparent(OBJECT(dev)); - exit(1); - } + qdev_init_nofail(dev); return pci_dev; } |