From nobody Tue Feb 10 22:18:27 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1529294689467480.50990629601426; Sun, 17 Jun 2018 21:04:49 -0700 (PDT) Received: from localhost ([::1]:60932 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fUlPM-0005sG-NI for importer@patchew.org; Mon, 18 Jun 2018 00:04:48 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49894) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fUlEd-0005QH-2r for qemu-devel@nongnu.org; Sun, 17 Jun 2018 23:53:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fUlEb-00044J-9K for qemu-devel@nongnu.org; Sun, 17 Jun 2018 23:53:43 -0400 Received: from ozlabs.org ([2401:3900:2:1::2]:47469) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fUlEa-00040E-OQ; Sun, 17 Jun 2018 23:53:41 -0400 Received: by ozlabs.org (Postfix, from userid 1007) id 418HJC0n6Qz9sB7; Mon, 18 Jun 2018 13:53:30 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1529294011; bh=3AqTzEfVe+KhgnGULbjgd1ROl72U38J1Hoel1Z08ZZQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=APojGkSFjkIz4b4bJCtqvU7fl2GrMLqRID40NbJjvtvlUwAO0VZ9riwTJQEEaTwyH ksDLF+qzRFoNcN6A5ROI4JQSawt1NfDBuYz+Z9OM45B1EfQy6dn7HlWHy6K8ix7tlH rRu58lPglnL8hMEEf9CqDLO/JVyC1AP/ic62rifM= From: David Gibson To: peter.maydell@linaro.org Date: Mon, 18 Jun 2018 13:53:19 +1000 Message-Id: <20180618035324.19907-24-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180618035324.19907-1-david@gibson.dropbear.id.au> References: <20180618035324.19907-1-david@gibson.dropbear.id.au> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2401:3900:2:1::2 Subject: [Qemu-devel] [PULL 23/28] spapr_cpu_core: fix potential leak in spapr_cpu_core_realize() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: aik@ozlabs.ru, agraf@suse.de, qemu-devel@nongnu.org, groug@kaod.org, qemu-ppc@nongnu.org, clg@kaod.org, David Gibson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Greg Kurz Commit 94ad93bd97684 (QEMU 2.12) switched to instantiate CPUs separately but it missed to adapt the error path accordingly. If something fails in the CPU creation loop, then the CPU object that was just created is leaked. The error paths in this function are a bit obfuscated, and adding yet another label to free this CPU object makes it worse. We should move the block of the loop to a separate function, with a proper rollback path, but this is a bigger cleanup. For now, let's just fix the bug by adding the missing calls to object_unref(). This will allow easier backport to older QEMU versions. Signed-off-by: Greg Kurz Signed-off-by: David Gibson --- hw/ppc/spapr_cpu_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c index ad404d13ec..a9bb2d61e8 100644 --- a/hw/ppc/spapr_cpu_core.c +++ b/hw/ppc/spapr_cpu_core.c @@ -187,6 +187,7 @@ static void spapr_cpu_core_realize(DeviceState *dev, Er= ror **errp) cs->cpu_index =3D cc->core_id + i; spapr_set_vcpu_id(cpu, cs->cpu_index, &local_err); if (local_err) { + object_unref(obj); goto err; } =20 @@ -198,6 +199,7 @@ static void spapr_cpu_core_realize(DeviceState *dev, Er= ror **errp) object_property_add_child(OBJECT(sc), id, obj, &local_err); g_free(id); if (local_err) { + object_unref(obj); goto err; } object_unref(obj); --=20 2.17.1