Output of default values in device help is broken:

    $ ./qemu-system-x86_64 -S -display none -monitor stdio
    QEMU 5.2.50 monitor - type 'help' for more information
    (qemu) device_add pvpanic,help
    pvpanic options:
      events=<uint8>         -  (default: (null))
      ioport=<uint16>        -  (default: (null))
      pvpanic[0]=<child<qemu:memory-region>>

The "(null)" is glibc printing a null pointer.  Other systems crash
instead.  Having a help request crash a running VM can really spoil
your day.

Root cause is a botched replacement of qstring_free() by
g_string_free(): to get the string back, we need to pass true to the
former, but false to the latter.  Fix the argument.

Fixes: eab3a4678b07267c39e7290a6e9e7690b1d2a521
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qom/object_interfaces.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
index c3324b0f86..bd8a947a63 100644
--- a/qom/object_interfaces.c
+++ b/qom/object_interfaces.c
@@ -159,7 +159,7 @@ char *object_property_help(const char *name, const char *type,
     }
     if (defval) {
         g_autofree char *def_json = g_string_free(qobject_to_json(defval),
-                                                  true);
+                                                  false);
         g_string_append_printf(str, " (default: %s)", def_json);
     }
 
-- 
2.26.3

On Wed, Mar 24, 2021 at 12:41 PM Markus Armbruster <armbru@redhat.com>
wrote:

> Output of default values in device help is broken:
>
>     $ ./qemu-system-x86_64 -S -display none -monitor stdio
>     QEMU 5.2.50 monitor - type 'help' for more information
>     (qemu) device_add pvpanic,help
>     pvpanic options:
>       events=<uint8>         -  (default: (null))
>       ioport=<uint16>        -  (default: (null))
>       pvpanic[0]=<child<qemu:memory-region>>
>
> The "(null)" is glibc printing a null pointer.  Other systems crash
> instead.  Having a help request crash a running VM can really spoil
> your day.
>
> Root cause is a botched replacement of qstring_free() by
> g_string_free(): to get the string back, we need to pass true to the
> former, but false to the latter.  Fix the argument.
>
> Fixes: eab3a4678b07267c39e7290a6e9e7690b1d2a521
> Reported-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

---
>  qom/object_interfaces.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
> index c3324b0f86..bd8a947a63 100644
> --- a/qom/object_interfaces.c
> +++ b/qom/object_interfaces.c
> @@ -159,7 +159,7 @@ char *object_property_help(const char *name, const
> char *type,
>      }
>      if (defval) {
>          g_autofree char *def_json = g_string_free(qobject_to_json(defval),
> -                                                  true);
> +                                                  false);
>          g_string_append_printf(str, " (default: %s)", def_json);
>      }
>
> --
> 2.26.3
>
>

On 24/03/2021 09.41, Markus Armbruster wrote:
> Output of default values in device help is broken:
> 
>      $ ./qemu-system-x86_64 -S -display none -monitor stdio
>      QEMU 5.2.50 monitor - type 'help' for more information
>      (qemu) device_add pvpanic,help
>      pvpanic options:
>        events=<uint8>         -  (default: (null))
>        ioport=<uint16>        -  (default: (null))
>        pvpanic[0]=<child<qemu:memory-region>>
> 
> The "(null)" is glibc printing a null pointer.  Other systems crash
> instead.  Having a help request crash a running VM can really spoil
> your day.
> 
> Root cause is a botched replacement of qstring_free() by
> g_string_free(): to get the string back, we need to pass true to the
> former, but false to the latter.  Fix the argument.
> 
> Fixes: eab3a4678b07267c39e7290a6e9e7690b1d2a521
> Reported-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>   qom/object_interfaces.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
> index c3324b0f86..bd8a947a63 100644
> --- a/qom/object_interfaces.c
> +++ b/qom/object_interfaces.c
> @@ -159,7 +159,7 @@ char *object_property_help(const char *name, const char *type,
>       }
>       if (defval) {
>           g_autofree char *def_json = g_string_free(qobject_to_json(defval),
> -                                                  true);
> +                                                  false);
>           g_string_append_printf(str, " (default: %s)", def_json);
>       }
>   
> 

Reviewed-by: Thomas Huth <thuth@redhat.com>