aboutsummaryrefslogtreecommitdiff
path: root/hw/vfio
diff options
context:
space:
mode:
authorAvihai Horon <avihaih@nvidia.com>2023-07-04 16:39:27 +0300
committerCédric Le Goater <clg@redhat.com>2023-07-10 09:52:52 +0200
commit8af87a3ec7e42ff1b9cf75ceee0451c31e34d153 (patch)
tree0ff27c6d09a9ffc653357c7e8aa08e4f1876dca2 /hw/vfio
parentd4a2af747d5a4b58c685a14d0bde7c4f65679bb5 (diff)
downloadqemu-8af87a3ec7e42ff1b9cf75ceee0451c31e34d153.zip
qemu-8af87a3ec7e42ff1b9cf75ceee0451c31e34d153.tar.gz
qemu-8af87a3ec7e42ff1b9cf75ceee0451c31e34d153.tar.bz2
vfio: Fix null pointer dereference bug in vfio_bars_finalize()
vfio_realize() has the following flow: 1. vfio_bars_prepare() -- sets VFIOBAR->size. 2. msix_early_setup(). 3. vfio_bars_register() -- allocates VFIOBAR->mr. After vfio_bars_prepare() is called msix_early_setup() can fail. If it does fail, vfio_bars_register() is never called and VFIOBAR->mr is not allocated. In this case, vfio_bars_finalize() is called as part of the error flow to free the bars' resources. However, vfio_bars_finalize() calls object_unparent() for VFIOBAR->mr after checking only VFIOBAR->size, and thus we get a null pointer dereference. Fix it by checking VFIOBAR->mr in vfio_bars_finalize(). Fixes: 89d5202edc50 ("vfio/pci: Allow relocating MSI-X MMIO") Signed-off-by: Avihai Horon <avihaih@nvidia.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
Diffstat (limited to 'hw/vfio')
-rw-r--r--hw/vfio/pci.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 68dd992..c89fdf7 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1752,9 +1752,11 @@ static void vfio_bars_finalize(VFIOPCIDevice *vdev)
vfio_bar_quirk_finalize(vdev, i);
vfio_region_finalize(&bar->region);
- if (bar->size) {
+ if (bar->mr) {
+ assert(bar->size);
object_unparent(OBJECT(bar->mr));
g_free(bar->mr);
+ bar->mr = NULL;
}
}