ppc: fix double-free in cpu_post_load()

[Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()

Posted by Greg Kurz 8 years, 6 months ago

When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
because of "double free or corruption (!prev)". The crash happens because
error_report_err() has already called error_free().

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 target/ppc/machine.c |    1 -
 1 file changed, 1 deletion(-)

diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index f578156dd411..abe0a1cdf021 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
         ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
         if (local_err) {
             error_report_err(local_err);
-            error_free(local_err);
             return -1;
         }
     } else

Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()

Posted by Eric Blake 8 years, 6 months ago

On 08/02/2017 12:34 PM, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
>  target/ppc/machine.c |    1 -
>  1 file changed, 1 deletion(-)

Reviewed-by: Eric Blake <eblake@redhat.com>

> 
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
>          ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
>          if (local_err) {
>              error_report_err(local_err);
> -            error_free(local_err);
>              return -1;
>          }
>      } else
> 
> 
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()

Posted by Philippe Mathieu-Daudé 8 years, 6 months ago

On 08/02/2017 02:34 PM, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

> ---
>   target/ppc/machine.c |    1 -
>   1 file changed, 1 deletion(-)
> 
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
>           ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
>           if (local_err) {
>               error_report_err(local_err);
> -            error_free(local_err);
>               return -1;
>           }
>       } else
> 
>

Re: [Qemu-devel] [PATCH] ppc: fix double-free in cpu_post_load()

Posted by David Gibson 8 years, 6 months ago

On Wed, Aug 02, 2017 at 07:34:16PM +0200, Greg Kurz wrote:
> When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
> because of "double free or corruption (!prev)". The crash happens because
> error_report_err() has already called error_free().
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Oops, that's a bit embarassing.  Applied to ppc-for-2.10.

> ---
>  target/ppc/machine.c |    1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/target/ppc/machine.c b/target/ppc/machine.c
> index f578156dd411..abe0a1cdf021 100644
> --- a/target/ppc/machine.c
> +++ b/target/ppc/machine.c
> @@ -239,7 +239,6 @@ static int cpu_post_load(void *opaque, int version_id)
>          ppc_set_compat(cpu, cpu->compat_pvr, &local_err);
>          if (local_err) {
>              error_report_err(local_err);
> -            error_free(local_err);
>              return -1;
>          }
>      } else
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson