1. Patchew
  2. QEMU
  3. View series

[PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()

Stefan Hajnoczi posted 1 patch 4 years, 3 months ago
Test checkpatch passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20211102163342.31162-1-stefanha@redhat.com
Maintainers: Paolo Bonzini <pbonzini@redhat.com>, "Daniel P. Berrangé" <berrange@redhat.com>, Eduardo Habkost <ehabkost@redhat.com>
softmmu/qdev-monitor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Stefan Hajnoczi 4 years, 3 months ago 
Reported by Coverity (CID 1465222).

Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
Cc: Damien Hedde <damien.hedde@greensocs.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 softmmu/qdev-monitor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index 4851de51a5..06f86a1a96 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
         if (prop) {
             dev->id = id;
         } else {
-            g_free(id);
             error_setg(errp, "Duplicate device ID '%s'", id);
+            g_free(id);
             return NULL;
         }
     } else {
-- 
2.31.1
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Philippe Mathieu-Daudé 4 years, 3 months ago 
On 11/2/21 17:33, Stefan Hajnoczi wrote:
> Reported by Coverity (CID 1465222).
> 
> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
> Cc: Damien Hedde <damien.hedde@greensocs.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  softmmu/qdev-monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> index 4851de51a5..06f86a1a96 100644
> --- a/softmmu/qdev-monitor.c
> +++ b/softmmu/qdev-monitor.c
> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
>          if (prop) {
>              dev->id = id;
>          } else {
> -            g_free(id);
>              error_setg(errp, "Duplicate device ID '%s'", id);
> +            g_free(id);
>              return NULL;
>          }

Ouch.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Michael S. Tsirkin 4 years, 3 months ago 
On Tue, Nov 02, 2021 at 04:33:42PM +0000, Stefan Hajnoczi wrote:
> Reported by Coverity (CID 1465222).
> 
> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
> Cc: Damien Hedde <damien.hedde@greensocs.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Ouch.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  softmmu/qdev-monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> index 4851de51a5..06f86a1a96 100644
> --- a/softmmu/qdev-monitor.c
> +++ b/softmmu/qdev-monitor.c
> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
>          if (prop) {
>              dev->id = id;
>          } else {
> -            g_free(id);
>              error_setg(errp, "Duplicate device ID '%s'", id);
> +            g_free(id);
>              return NULL;
>          }
>      } else {
> -- 
> 2.31.1
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Kevin Wolf 4 years, 3 months ago 
Am 02.11.2021 um 17:33 hat Stefan Hajnoczi geschrieben:
> Reported by Coverity (CID 1465222).
> 
> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
> Cc: Damien Hedde <damien.hedde@greensocs.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Oops, this is an embarrassing one. Sorry, my fault, not Damien's.

Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Philippe Mathieu-Daudé 4 years, 3 months ago 
Cc'ing Markus

On 11/2/21 17:33, Stefan Hajnoczi wrote:
> Reported by Coverity (CID 1465222).
> 
> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
> Cc: Damien Hedde <damien.hedde@greensocs.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  softmmu/qdev-monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> index 4851de51a5..06f86a1a96 100644
> --- a/softmmu/qdev-monitor.c
> +++ b/softmmu/qdev-monitor.c
> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
>          if (prop) {
>              dev->id = id;
>          } else {
> -            g_free(id);
>              error_setg(errp, "Duplicate device ID '%s'", id);
> +            g_free(id);
>              return NULL;
>          }
>      } else {
> 

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Markus Armbruster 4 years, 3 months ago 
Philippe Mathieu-Daudé <philmd@redhat.com> writes:

> Cc'ing Markus
>
> On 11/2/21 17:33, Stefan Hajnoczi wrote:
>> Reported by Coverity (CID 1465222).
>> 
>> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
>> Cc: Damien Hedde <damien.hedde@greensocs.com>
>> Cc: Kevin Wolf <kwolf@redhat.com>
>> Cc: Michael S. Tsirkin <mst@redhat.com>
>> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
>> ---
>>  softmmu/qdev-monitor.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
>> index 4851de51a5..06f86a1a96 100644
>> --- a/softmmu/qdev-monitor.c
>> +++ b/softmmu/qdev-monitor.c
>> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
>>          if (prop) {
>>              dev->id = id;
>>          } else {
>> -            g_free(id);
>>              error_setg(errp, "Duplicate device ID '%s'", id);
>> +            g_free(id);
>>              return NULL;
>>          }
>>      } else {
>> 
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Markus Armbruster 4 years, 2 months ago 
Nominating for qemu-trivial.

Markus Armbruster <armbru@redhat.com> writes:

> Philippe Mathieu-Daudé <philmd@redhat.com> writes:
>
>> Cc'ing Markus
>>
>> On 11/2/21 17:33, Stefan Hajnoczi wrote:
>>> Reported by Coverity (CID 1465222).
>>> 
>>> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
>>> Cc: Damien Hedde <damien.hedde@greensocs.com>
>>> Cc: Kevin Wolf <kwolf@redhat.com>
>>> Cc: Michael S. Tsirkin <mst@redhat.com>
>>> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
>>> ---
>>>  softmmu/qdev-monitor.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>> 
>>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
>>> index 4851de51a5..06f86a1a96 100644
>>> --- a/softmmu/qdev-monitor.c
>>> +++ b/softmmu/qdev-monitor.c
>>> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
>>>          if (prop) {
>>>              dev->id = id;
>>>          } else {
>>> -            g_free(id);
>>>              error_setg(errp, "Duplicate device ID '%s'", id);
>>> +            g_free(id);
>>>              return NULL;
>>>          }
>>>      } else {
>>> 
>>
>> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
>
> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Re: [PATCH] softmmu/qdev-monitor: fix use-after-free in qdev_set_id()
Posted by Kevin Wolf 4 years, 2 months ago 
Am 13.11.2021 um 09:14 hat Markus Armbruster geschrieben:
> Nominating for qemu-trivial.

I'm sending a pull request anyway, so I'm merging it.

Kevin

> Markus Armbruster <armbru@redhat.com> writes:
> 
> > Philippe Mathieu-Daudé <philmd@redhat.com> writes:
> >
> >> Cc'ing Markus
> >>
> >> On 11/2/21 17:33, Stefan Hajnoczi wrote:
> >>> Reported by Coverity (CID 1465222).
> >>> 
> >>> Fixes: 4a1d937796de0fecd8b22d7dbebf87f38e8282fd ("softmmu/qdev-monitor: add error handling in qdev_set_id")
> >>> Cc: Damien Hedde <damien.hedde@greensocs.com>
> >>> Cc: Kevin Wolf <kwolf@redhat.com>
> >>> Cc: Michael S. Tsirkin <mst@redhat.com>
> >>> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> >>> ---
> >>>  softmmu/qdev-monitor.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>> 
> >>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> >>> index 4851de51a5..06f86a1a96 100644
> >>> --- a/softmmu/qdev-monitor.c
> >>> +++ b/softmmu/qdev-monitor.c
> >>> @@ -581,8 +581,8 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
> >>>          if (prop) {
> >>>              dev->id = id;
> >>>          } else {
> >>> -            g_free(id);
> >>>              error_setg(errp, "Duplicate device ID '%s'", id);
> >>> +            g_free(id);
> >>>              return NULL;
> >>>          }
> >>>      } else {
> >>> 
> >>
> >> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> >> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
> >
> > Reviewed-by: Markus Armbruster <armbru@redhat.com>
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.