[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] hw/pci: use-after-free in pci_nic_init_nofail w

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH] hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
Date: Mon, 9 Jan 2017 12:04:52 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1

On 2017年01月08日 12:00, Michael S. Tsirkin wrote:
On Fri, Jan 06, 2017 at 03:48:27PM -0800, Alex Kompel wrote:
object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.

(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"

Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440     in qom/object.c
(gdb) bt
#0  object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
#1  0x000055555598c30d in pci_nic_init_nofail (nd=0x55555616b460
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
#2  0x00005555557ff52c in pc_nic_init (isa_bus=0x55555733c610,
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
#3  0x00005555558021ad in pc_init1 (machine=0x55555661ee10,
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
#4  0x00005555557519cb in main (argc=<optimized out>, argv=<optimized
out>, envp=<optimized out>) at vl.c:4481

Signed-off-by: Alex Kompel <address@hidden>
More a nic thing than pci really ...

Jason, could you pls merge this?

Acked-by: Michael S. Tsirkin <address@hidden>

Ok, will pick.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]