Skip to content
  • Anthony Liguori's avatar
    qdev: fix use-after-free in the error path of qdev_init_nofail · 7de3abe5
    Anthony Liguori authored
    
    
    From Markus:
    
    Before:
    
        $ qemu-system-x86_64 -display none -drive if=ide
        qemu-system-x86_64: Device needs media, but drive is empty
        qemu-system-x86_64: Initialization of device ide-hd failed
        [Exit 1 ]
    
    After:
    
        $ qemu-system-x86_64 -display none -drive if=ide
        qemu-system-x86_64: Device needs media, but drive is empty
        Segmentation fault (core dumped)
        [Exit 139 (SIGSEGV)]
    
    This error always existed as qdev_init() frees the object.  But QOM
    goes a bit further and purposefully sets the class pointer to NULL to
    help find use-after-free.  It worked :-)
    
    Cc: Andreas Faerber <afaerber@suse.de>
    Reported-by: default avatarMarkus Armbruster <armbru@redhat.com>
    Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
    7de3abe5