diff options
| author | Alex Kompel <barbos@gmail.com> | 2017-01-06 15:48:27 -0800 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2017-01-20 10:58:26 +0800 |
| commit | a023b7ac6262106e9a7d248bb61ec928fbf94896 (patch) | |
| tree | 8a8018dc688500a9aa5f08cdd24720782444c573 /net/tap.c | |
| parent | 581f7b127dfe9ed10ce3216e440cc5be1582911b (diff) | |
| download | qemu-a023b7ac6262106e9a7d248bb61ec928fbf94896.tar.gz | |
hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.
(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"
Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440 in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481
Signed-off-by: Alex Kompel <barbos@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net/tap.c')
0 files changed, 0 insertions, 0 deletions