|
 |
7711c0 |
From 689898009c6930b8a9ce598e85678bfc0f131594 Mon Sep 17 00:00:00 2001
|
|
|
7711c0 |
From: Markus Armbruster <armbru@redhat.com>
|
|
|
7711c0 |
Date: Fri, 17 May 2019 06:50:51 +0200
|
|
|
7711c0 |
Subject: [PATCH 24/53] block/pflash_cfi02: Fix memory leak and potential
|
|
|
7711c0 |
use-after-free
|
|
|
7711c0 |
MIME-Version: 1.0
|
|
|
7711c0 |
Content-Type: text/plain; charset=UTF-8
|
|
|
7711c0 |
Content-Transfer-Encoding: 8bit
|
|
|
7711c0 |
|
|
|
7711c0 |
RH-Author: Markus Armbruster <armbru@redhat.com>
|
|
|
7711c0 |
Message-id: <20190517065120.12028-3-armbru@redhat.com>
|
|
|
7711c0 |
Patchwork-id: 87984
|
|
|
7711c0 |
O-Subject: [RHEL-7.7 qemu-kvm-rhev PATCH v3 02/31] block/pflash_cfi02: Fix memory leak and potential use-after-free
|
|
|
7711c0 |
Bugzilla: 1624009
|
|
|
7711c0 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
7711c0 |
|
|
|
7711c0 |
From: Stephen Checkoway <stephen.checkoway@oberlin.edu>
|
|
|
7711c0 |
|
|
|
7711c0 |
Don't dynamically allocate the pflash's timer. But do use timer_del in
|
|
|
7711c0 |
an unrealize function to make sure that the timer can't fire after the
|
|
|
7711c0 |
pflash_t has been freed.
|
|
|
7711c0 |
|
|
|
7711c0 |
Signed-off-by: Stephen Checkoway <stephen.checkoway@oberlin.edu>
|
|
|
7711c0 |
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
7711c0 |
Reviewed-by: Wei Yang <richardw.yang@linux.intel.com>
|
|
|
7711c0 |
Message-Id: <20190219153727.62279-1-stephen.checkoway@oberlin.edu>
|
|
|
7711c0 |
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
|
|
|
7711c0 |
(cherry picked from commit d80cf1eb2e87df3a9bfb226bcc7fb3a1aa858817)
|
|
|
7711c0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
7711c0 |
---
|
|
|
7711c0 |
hw/block/pflash_cfi02.c | 15 +++++++++++----
|
|
|
7711c0 |
1 file changed, 11 insertions(+), 4 deletions(-)
|
|
|
7711c0 |
|
|
|
7711c0 |
diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
|
|
|
7711c0 |
index 75d1ae1..cbc3d4d 100644
|
|
|
7711c0 |
--- a/hw/block/pflash_cfi02.c
|
|
|
7711c0 |
+++ b/hw/block/pflash_cfi02.c
|
|
|
7711c0 |
@@ -84,7 +84,7 @@ struct pflash_t {
|
|
|
7711c0 |
uint16_t unlock_addr0;
|
|
|
7711c0 |
uint16_t unlock_addr1;
|
|
|
7711c0 |
uint8_t cfi_table[0x52];
|
|
|
7711c0 |
- QEMUTimer *timer;
|
|
|
7711c0 |
+ QEMUTimer timer;
|
|
|
7711c0 |
/* The device replicates the flash memory across its memory space. Emulate
|
|
|
7711c0 |
* that by having a container (.mem) filled with an array of aliases
|
|
|
7711c0 |
* (.mem_mappings) pointing to the flash memory (.orig_mem).
|
|
|
7711c0 |
@@ -431,7 +431,7 @@ static void pflash_write (pflash_t *pfl, hwaddr offset,
|
|
|
7711c0 |
}
|
|
|
7711c0 |
pfl->status = 0x00;
|
|
|
7711c0 |
/* Let's wait 5 seconds before chip erase is done */
|
|
|
7711c0 |
- timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
|
|
|
7711c0 |
+ timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
|
|
|
7711c0 |
(NANOSECONDS_PER_SECOND * 5));
|
|
|
7711c0 |
break;
|
|
|
7711c0 |
case 0x30:
|
|
|
7711c0 |
@@ -446,7 +446,7 @@ static void pflash_write (pflash_t *pfl, hwaddr offset,
|
|
|
7711c0 |
}
|
|
|
7711c0 |
pfl->status = 0x00;
|
|
|
7711c0 |
/* Let's wait 1/2 second before sector erase is done */
|
|
|
7711c0 |
- timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
|
|
|
7711c0 |
+ timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
|
|
|
7711c0 |
(NANOSECONDS_PER_SECOND / 2));
|
|
|
7711c0 |
break;
|
|
|
7711c0 |
default:
|
|
|
7711c0 |
@@ -658,7 +658,7 @@ static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
|
|
|
7711c0 |
pfl->rom_mode = 1;
|
|
|
7711c0 |
sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
|
|
|
7711c0 |
|
|
|
7711c0 |
- pfl->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
|
|
|
7711c0 |
+ timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
|
|
|
7711c0 |
pfl->wcycle = 0;
|
|
|
7711c0 |
pfl->cmd = 0;
|
|
|
7711c0 |
pfl->status = 0;
|
|
|
7711c0 |
@@ -757,11 +757,18 @@ static Property pflash_cfi02_properties[] = {
|
|
|
7711c0 |
DEFINE_PROP_END_OF_LIST(),
|
|
|
7711c0 |
};
|
|
|
7711c0 |
|
|
|
7711c0 |
+static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp)
|
|
|
7711c0 |
+{
|
|
|
7711c0 |
+ pflash_t *pfl = CFI_PFLASH02(dev);
|
|
|
7711c0 |
+ timer_del(&pfl->timer);
|
|
|
7711c0 |
+}
|
|
|
7711c0 |
+
|
|
|
7711c0 |
static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
|
|
|
7711c0 |
{
|
|
|
7711c0 |
DeviceClass *dc = DEVICE_CLASS(klass);
|
|
|
7711c0 |
|
|
|
7711c0 |
dc->realize = pflash_cfi02_realize;
|
|
|
7711c0 |
+ dc->unrealize = pflash_cfi02_unrealize;
|
|
|
7711c0 |
dc->props = pflash_cfi02_properties;
|
|
|
7711c0 |
set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
|
|
|
7711c0 |
}
|
|
|
7711c0 |
--
|
|
|
7711c0 |
1.8.3.1
|
|
|
7711c0 |
|