Commit a023b7ac authored by Alex Kompel's avatar Alex Kompel Committed by Jason Wang
Browse files

hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize 



object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.

(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"

Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440     in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481

Signed-off-by: default avatarAlex Kompel <barbos@gmail.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent 581f7b12

hw/pci/pci.c

+1 −8
Original line number Diff line number Diff line
@@ -1779,7 +1779,6 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus, 
                               const char *default_devaddr)

{

    const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;

    Error *err = NULL;

    PCIBus *bus;

    PCIDevice *pci_dev;

    DeviceState *dev;
@@ -1805,13 +1804,7 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus, 
    pci_dev = pci_create(bus, devfn, pci_nic_names[i]);

    dev = &pci_dev->qdev;

    qdev_set_nic_properties(dev, nd);



    object_property_set_bool(OBJECT(dev), true, "realized", &err);

    if (err) {

        error_report_err(err);

        object_unparent(OBJECT(dev));

        exit(1);

    }

    qdev_init_nofail(dev);



    return pci_dev;

}