aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi/esp-pci.c
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2023-04-03 16:12:30 +0100
committerPeter Maydell <peter.maydell@linaro.org>2023-04-03 16:12:30 +0100
commit12148d442ec3f4386c8624ffcf44c61a8b344018 (patch)
treec976557356f206de2a7c3cdf7db1371e62f8747c /hw/scsi/esp-pci.c
parentb15bdc965106a10dbac2e50dc598ee7fd926ff14 (diff)
downloadqemu-12148d442ec3f4386c8624ffcf44c61a8b344018.zip
qemu-12148d442ec3f4386c8624ffcf44c61a8b344018.tar.gz
qemu-12148d442ec3f4386c8624ffcf44c61a8b344018.tar.bz2
hw/arm: do not free machine->fdt in arm_load_dtb()
At this moment, arm_load_dtb() can free machine->fdt when binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to machine->fdt. And, in that case, the existing g_free(fdt) at the end of arm_load_dtb() will make machine->fdt point to an invalid memory region. Since monitor command 'dumpdtb' was introduced a couple of releases ago, running it with any ARM machine that uses arm_load_dtb() will crash QEMU. Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead of freeing 'fdt', assign it back to ms->fdt. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-id: 20230328165935.1512846-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/scsi/esp-pci.c')
0 files changed, 0 insertions, 0 deletions