[PATCH v2 1/2] qom: improve use-after-free debugging

Roman Kiryanov posted 2 patches 2 months, 2 weeks ago
Maintainers: "Michael S. Tsirkin" <mst@redhat.com>, "Alex Bennée" <alex.bennee@linaro.org>, Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>, Dmitry Osipenko <dmitry.osipenko@collabora.com>, Paolo Bonzini <pbonzini@redhat.com>, "Daniel P. Berrangé" <berrange@redhat.com>
[PATCH v2 1/2] qom: improve use-after-free debugging
Posted by Roman Kiryanov 2 months, 2 weeks ago
This patch invalidates dead objects so their usage will
lead to more predictable results (crashes or asserts).

Signed-off-by: Roman Kiryanov <rkir@google.com>
---
Changes in v2:
- Updated clearing of obj->properties using g_clear_pointer.
- Moved clearing of obj->class into object_deinit.
- obj->class is checked to be NULL before obj->free(obj).

 qom/object.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/qom/object.c b/qom/object.c
index f981e27044..b8ffb00976 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -612,7 +612,7 @@ static void object_property_del_all(Object *obj)
         }
     } while (released);
 
-    g_hash_table_unref(obj->properties);
+    g_clear_pointer(&obj->properties, g_hash_table_unref);
 }
 
 static void object_property_del_child(Object *obj, Object *child)
@@ -658,6 +658,9 @@ static void object_deinit(Object *obj, TypeImpl *type)
     if (type_has_parent(type)) {
         object_deinit(obj, type_get_parent(type));
     }
+
+    g_assert(obj->properties == NULL);
+    obj->class = NULL;
 }
 
 static void object_finalize(void *data)
@@ -670,6 +673,7 @@ static void object_finalize(void *data)
 
     g_assert(obj->ref == 0);
     g_assert(obj->parent == NULL);
+    g_assert(obj->class == NULL);
     if (obj->free) {
         obj->free(obj);
     }
-- 
2.54.0.545.g6539524ca2-goog
Re: [PATCH v2 1/2] qom: improve use-after-free debugging
Posted by Philippe Mathieu-Daudé 2 months ago
On 28/4/26 18:45, Roman Kiryanov wrote:
> This patch invalidates dead objects so their usage will
> lead to more predictable results (crashes or asserts).
> 
> Signed-off-by: Roman Kiryanov <rkir@google.com>
> ---
> Changes in v2:
> - Updated clearing of obj->properties using g_clear_pointer.
> - Moved clearing of obj->class into object_deinit.
> - obj->class is checked to be NULL before obj->free(obj).
> 
>   qom/object.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>