diff options
| author | Alex Kompel | 2017-01-07 00:48:27 +0100 |
|---|---|---|
| committer | Jason Wang | 2017-01-20 03:58:26 +0100 |
| commit | a023b7ac6262106e9a7d248bb61ec928fbf94896 (patch) | |
| tree | 8a8018dc688500a9aa5f08cdd24720782444c573 /include/exec/memory.h | |
| parent | hw/net/dp8393x: Avoid unintentional sign extensions on addresses (diff) | |
| download | qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.tar.gz qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.tar.xz qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.zip | |
hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.
(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"
Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440 in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481
Signed-off-by: Alex Kompel <barbos@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'include/exec/memory.h')
0 files changed, 0 insertions, 0 deletions