[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH] qom-qmp-cmds: remove unnecessary alloc in qmp_object_add to fix

From: Pan Nengyuan
Subject: [PATCH] qom-qmp-cmds: remove unnecessary alloc in qmp_object_add to fix memleak
Date: Fri, 13 Mar 2020 15:58:58 +0800

In qmp_object_add(), user_creatable_add_type() may set errp with some error 
message and
return NULL. In this case, qmp_object_add() still alloc memory to *ret_data 
which return
to the caller and causes a memory leak.

This patch do this alloc() action only if obj is not NULL to fix it. And 
initialize ret_data
in xen-block to avoid a possible uninitialized error.

The Leak stack:
Direct leak of 4120 byte(s) in 1 object(s) allocated from:
    #0 0x7f6106ce5970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
    #1 0x7f6105e6a49d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
    #2 0x55d2c58c17fd in qdict_new 
    #3 0x55d2c53a0051 in qmp_object_add 
    #4 0x55d2c57b47da in do_qmp_dispatch 
    #5 0x55d2c57b47da in qmp_dispatch 
    #6 0x55d2c52f1430 in monitor_qmp_dispatch 
    #7 0x55d2c52f3087 in monitor_qmp_bh_dispatcher 
    #8 0x55d2c58e6153 in aio_bh_call 

Fixes: 5f07c4d60d091320186e7b0edaf9ed2cc16b2d1e
Reported-by: Euler Robot <address@hidden>
Signed-off-by: Pan Nengyuan <address@hidden>
Cc: Kevin Wolf <address@hidden>
 hw/block/xen-block.c | 2 +-
 qom/qom-qmp-cmds.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index 3885464513..041866b846 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -860,7 +860,7 @@ static XenBlockIOThread *xen_block_iothread_create(const 
char *id,
     XenBlockIOThread *iothread = g_new(XenBlockIOThread, 1);
     Error *local_err = NULL;
     QDict *opts;
-    QObject *ret_data;
+    QObject *ret_data = NULL;
     iothread->id = g_strdup(id);
diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
index 435193b036..6bd137ccbf 100644
--- a/qom/qom-qmp-cmds.c
+++ b/qom/qom-qmp-cmds.c
@@ -287,8 +287,8 @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error 
     if (obj) {
+        *ret_data = QOBJECT(qdict_new());
-    *ret_data = QOBJECT(qdict_new());
 void qmp_object_del(const char *id, Error **errp)

reply via email to

[Prev in Thread] Current Thread [Next in Thread]