On 230328 1859, Markus Armbruster wrote: > At this moment, arm_load_dtb() can free machine->fdt when > binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be > retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is > the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to > machine->fdt. And, in that case, the existing g_free(fdt) at the end of > arm_load_dtb() will make machine->fdt point to an invalid memory region. > > Since monitor command 'dumpdtb' was introduced a couple of releases > ago, running it with any ARM machine that uses arm_load_dtb() will > crash QEMU. > > Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead > of freeing 'fdt', assign it back to ms->fdt. > > Cc: Peter Maydell <peter.mayd...@linaro.org> > Cc: qemu-...@nongnu.org > Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") > Reported-by: Markus Armbruster <arm...@redhat.com>i ^ Seems like a typo
-Alex