| commit | 0d4104e5760221547fad158bbbb655a4e4c22b50 | |
| author | Fam Zheng <famz@redhat.com> | |
| Tue, 2 Aug 2016 03:41:41 +0000 (2 11:41 +0800) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Wed, 3 Aug 2016 16:44:57 +0000 (3 18:44 +0200) | ||
| tree | 08d271d2e0af843ebe9c5075906e20224c2407f8 | treesnapshot (tar.gz zip) |
| parent | f04ec5afbb7d60a56863add800fd90ceee66f362 | commitdiff |
qdev: Fix use after free in qdev_init_nofail error path
Since 69382d8b (qdev: Fix object reference leak in case device.realize()
fails), object_property_set_bool could release the object. The error
path wants the type name, so hold an reference before realizing it.
Cc: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <1470109301-12966-1-git-send-email-famz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Since 69382d8b (qdev: Fix object reference leak in case device.realize()
fails), object_property_set_bool could release the object. The error
path wants the type name, so hold an reference before realizing it.
Cc: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <1470109301-12966-1-git-send-email-famz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/core/qdev.c | diffblobblamehistory |