From nobody Tue Feb 10 10:03:22 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1681325513; cv=none; d=zohomail.com; s=zohoarc; b=ROP8YJ6/I5dwYP57q0VMy6zTq6VeGKrZoy95QzHCOxvDG+ygMYJ9dlfME9fFh70GQWw0rEgk6ra/GNg5tw3w1aHQfqEvbPHNtc8yrXApn4A2neWt6Z5P2I5KeC2QW+IjOSVSOfBJWMe73YbypgjvhPeEksQiTEQ7+sX7pCe8t3o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1681325513; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=pvefxXf1YhjL3JSf+V8JRgGjqQjxWW3E4QNSUXU8Vyk=; b=VEGdhyUea24awQ/dRFUo9vhqqhmtGa9pKCTM1VOEDQsn/MqtcmtpcSR1LX/hDd10HEx3GYUJr7KdQ6rgnOByvNxNv1+6q7E38f1ORUyMhl/TUqGWeL4fcpORjwdS3AUhUAMYC8jBGj2bNoy6Cy3ACgBH0EUqKlfsGDR/ODOV13Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1681325513835665.8342646911951; Wed, 12 Apr 2023 11:51:53 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.520312.807765 (Exim 4.92) (envelope-from ) id 1pmfYu-00025d-2G; Wed, 12 Apr 2023 18:51:20 +0000 Received: by outflank-mailman (output) from mailman id 520312.807765; Wed, 12 Apr 2023 18:51:20 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1pmfYt-00025V-Ub; Wed, 12 Apr 2023 18:51:19 +0000 Received: by outflank-mailman (input) for mailman id 520312; Wed, 12 Apr 2023 18:51:19 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1pmfYt-0001qk-4D for xen-devel@lists.xenproject.org; Wed, 12 Apr 2023 18:51:19 +0000 Received: from casper.infradead.org (casper.infradead.org [2001:8b0:10b:1236::1]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 00c6275a-d963-11ed-8611-37d641c3527e; Wed, 12 Apr 2023 20:51:15 +0200 (CEST) Received: from [2001:8b0:10b:5::ebe] (helo=i7.infradead.org) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1pmfYf-0077lE-7x; Wed, 12 Apr 2023 18:51:06 +0000 Received: from dwoodhou by i7.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1pmfYe-001r1R-2I; Wed, 12 Apr 2023 19:51:04 +0100 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list X-Inumbo-ID: 00c6275a-d963-11ed-8611-37d641c3527e DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Sender:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description; bh=pvefxXf1YhjL3JSf+V8JRgGjqQjxWW3E4QNSUXU8Vyk=; b=TjPE0dW5/ekjTjDaeeWQk5fUJV nNUgr4r4gwcl33okRN07A5zJwF7Q0B4b01PnDXOtfu3v7VarXGfsZZNSPBiwmIfLc2EdIZ2EGBo4o QTqoNs4SeLgJml9Y/6rUfD8FuNIh2wI+nWzJS/7XYaEwpMo+wj7PQJ9f5m1MKj8o0U6AFB1l5km3X rElR8Zf42jdPGjQ1hHcqk1DSpdw5yW/z9RBJwQGSUYukk2JFnGU7rFkK9jtVNSx3ySS6kedTvELwC pvVDHGxtrOnUPo8v7MBvIwMGNL0HzMnLXSZ8RfjifLwUOnrHdF05EhNKDHsy1O0kxGie2f4iVThoa QyhSoxew==; From: David Woodhouse To: qemu-devel@nongnu.org Cc: no Stabellini , Anthony Perard , Paul Durrant , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Paolo Bonzini , Richard Henderson , Eduardo Habkost , "Michael S. Tsirkin" , Marcel Apfelbaum , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Thomas Huth , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , xen-devel@lists.xenproject.org Subject: [PATCH 4/5] hw/xen: Fix double-free in xen_console store_con_info() Date: Wed, 12 Apr 2023 19:51:01 +0100 Message-Id: <20230412185102.441523-5-dwmw2@infradead.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230412185102.441523-1-dwmw2@infradead.org> References: <20230412185102.441523-1-dwmw2@infradead.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: David Woodhouse X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html X-ZohoMail-DKIM: pass (identity @infradead.org) X-ZM-MESSAGEID: 1681325515907100005 Content-Type: text/plain; charset="utf-8" From: David Woodhouse Coverity spotted a double-free (CID 1508254); we g_string_free(path) and then for some reason immediately call free(path) too. We should just use g_autoptr() for it anyway, which simplifies the code a bit. Fixes: 7a8a749da7d3 ("hw/xen: Move xenstore_store_pv_console_info to xen_co= nsole.c") Signed-off-by: David Woodhouse Reviewed-by: Paul Durrant Reviewed-by: Peter Maydell --- hw/char/xen_console.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c index c7a19c0e7c..810dae3f44 100644 --- a/hw/char/xen_console.c +++ b/hw/char/xen_console.c @@ -178,8 +178,7 @@ static int store_con_info(struct XenConsole *con) Chardev *cs =3D qemu_chr_fe_get_driver(&con->chr); char *pts =3D NULL; char *dom_path; - GString *path; - int ret =3D -1; + g_autoptr(GString) path =3D NULL; =20 /* Only continue if we're talking to a pty. */ if (!CHARDEV_IS_PTY(cs)) { @@ -204,15 +203,9 @@ static int store_con_info(struct XenConsole *con) =20 if (xenstore_write_str(con->console, path->str, pts)) { fprintf(stderr, "xenstore_write_str for '%s' fail", path->str); - goto out; + return -1; } - ret =3D 0; - -out: - g_string_free(path, true); - free(path); - - return ret; + return 0; } =20 static int con_init(struct XenLegacyDevice *xendev) --=20 2.39.2