hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
commita023b7ac6262106e9a7d248bb61ec928fbf94896
authorAlex Kompel <barbos@gmail.com>
Fri, 6 Jan 2017 23:48:27 +0000 (6 15:48 -0800)
committerJason Wang <jasowang@redhat.com>
Fri, 20 Jan 2017 02:58:26 +0000 (20 10:58 +0800)
tree8a8018dc688500a9aa5f08cdd24720782444c573
parent581f7b127dfe9ed10ce3216e440cc5be1582911b
hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize

object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.

(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"

Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440     in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481

Signed-off-by: Alex Kompel <barbos@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
hw/pci/pci.c