Re: [Qemu-devel] Use after free problem somewhere in ahci.c or ich.c code

[Philippe Mathieu-Daudé]

On 08/22/2017 03:39 PM, John Snow wrote:
> On 08/22/2017 02:15 PM, Thomas Huth wrote:
> > Looks like there is a use-after-free problem somewhere in
> > the ahci.c or ich.c code when trying to add the ich9-ahci
> > on a old PC machine. Using valgrind, I get:

those old PC don't support AHCI hotplug, so realize() fails then 
unparent() is called.

> I'll look; it looks like it works okay for pc-i440fx-2.9 as well as 2.0
> and 1.7.
>
> 1.6 appears to be the most modern board that has issues, as well as 1.4
> and the pc-1.2 board you specify.

commit 9e047b982452 "piix4: add acpi pci hotplug support"

"Add support for acpi pci hotplug using the new infrastructure.
PIIX4 legacy interface is maintained as is for machine types 1.7 and older."

I see piix4_pm_init() disabling use_acpi_pci_hotplug if xen_enabled(),
later when piix4_device_plug_cb() is called for TYPE_PCI_DEVICE it 
checks xen_enabled() instead of checking use_acpi_pci_hotplug.
Same happens in piix4_device_unplug_request_cb(), not sure it can be 
reached although.

My guess is changing !xen_enabled() -> s->use_acpi_pci_hotplug fixes 
this issue, but I'm not sure this is the safest way to fix it.

I'll send a patch.

Regards,

Phil.