Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Igor Mammedov
On Tue, 2 Aug 2016 15:05:28 +0200 Paolo Bonzini wrote: > On 02/08/2016 09:55, Igor Mammedov wrote: > > On Tue, 2 Aug 2016 11:41:41 +0800 > > Fam Zheng wrote: > > > >> Since 69382d8b (qdev: Fix object reference leak in case device.realize() > >> fails), object_property_set_bool could release

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Paolo Bonzini
On 02/08/2016 09:55, Igor Mammedov wrote: > On Tue, 2 Aug 2016 11:41:41 +0800 > Fam Zheng wrote: > >> Since 69382d8b (qdev: Fix object reference leak in case device.realize() >> fails), object_property_set_bool could release the object. The error >> path wants the type name, so hold an referen

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Fam Zheng
On Tue, 08/02 09:55, Igor Mammedov wrote: > qdev_init_nofail() { called with ref == 1 Yes it does. > object_property_set_bool(true, "realized") > if error: > ref == 1 ^ This is not the case for qdev, the object is actually released by object_property_set_bool if fa

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Igor Mammedov
On Tue, 2 Aug 2016 00:00:27 -0400 John Snow wrote: > On 08/01/2016 11:41 PM, Fam Zheng wrote: > > Since 69382d8b (qdev: Fix object reference leak in case device.realize() > > fails), object_property_set_bool could release the object. The error > > path wants the type name, so hold an reference be

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Fam Zheng
On Tue, 08/02 10:14, Igor Mammedov wrote: > On Tue, 2 Aug 2016 00:00:27 -0400 > John Snow wrote: > > > On 08/01/2016 11:41 PM, Fam Zheng wrote: > > > Since 69382d8b (qdev: Fix object reference leak in case device.realize() > > > fails), object_property_set_bool could release the object. The error

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-02 Thread Igor Mammedov
On Tue, 2 Aug 2016 11:41:41 +0800 Fam Zheng wrote: > Since 69382d8b (qdev: Fix object reference leak in case device.realize() > fails), object_property_set_bool could release the object. The error > path wants the type name, so hold an reference before realizing it. > > Cc: Igor Mammedov > Sig

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-01 Thread Paolo Bonzini
On 02/08/2016 06:00, John Snow wrote: > > > On 08/01/2016 11:41 PM, Fam Zheng wrote: >> Since 69382d8b (qdev: Fix object reference leak in case device.realize() >> fails), object_property_set_bool could release the object. The error >> path wants the type name, so hold an reference before reali

Re: [Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-01 Thread John Snow
On 08/01/2016 11:41 PM, Fam Zheng wrote: Since 69382d8b (qdev: Fix object reference leak in case device.realize() fails), object_property_set_bool could release the object. The error path wants the type name, so hold an reference before realizing it. Cc: Igor Mammedov Signed-off-by: Fam Zheng

[Qemu-devel] [PATCH] qdev: Fix use after free in qdev_init_nofail error path

2016-08-01 Thread Fam Zheng
Since 69382d8b (qdev: Fix object reference leak in case device.realize() fails), object_property_set_bool could release the object. The error path wants the type name, so hold an reference before realizing it. Cc: Igor Mammedov Signed-off-by: Fam Zheng --- hw/core/qdev.c | 2 ++ 1 file changed,