On 24/07/2017 20:27, Philippe Mathieu-Daudé wrote:
> hw/vfio/pci.c:308:29: warning: Use of memory after it is freed
> qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
> ^~~~
>
> Reported-by: Clang Static Analyzer
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> hw/vfio/pci.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
> index d4051cb951..31e1edf447 100644
> --- a/hw/vfio/pci.c
> +++ b/hw/vfio/pci.c
> @@ -257,7 +257,7 @@ static void vfio_intx_update(PCIDevice *pdev)
> static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
> {
> uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1);
> - int ret, argsz;
> + int ret, argsz, retval = 0;
> struct vfio_irq_set *irq_set;
> int32_t *pfd;
> Error *err = NULL;
> @@ -302,12 +302,12 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
> qemu_set_fd_handler(*pfd, vfio_intx_interrupt, NULL, vdev);
>
> ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
> - g_free(irq_set);
> if (ret) {
> error_setg_errno(errp, -ret, "failed to setup INTx fd");
> qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
> event_notifier_cleanup(&vdev->intx.interrupt);
> - return -errno;
> + retval = -errno;
> + goto cleanup;
> }
>
> vfio_intx_enable_kvm(vdev, &err);
> @@ -319,7 +319,10 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
>
> trace_vfio_intx_enable(vdev->vbasedev.name);
>
> - return 0;
> +cleanup:
> + g_free(irq_set);
> +
> + return retval;
> }
>
> static void vfio_intx_disable(VFIOPCIDevice *vdev)
>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>