|
 |
357786 |
From c8edc3f99b203feb6795d2d727c9b46058bcf3bd Mon Sep 17 00:00:00 2001
|
|
|
357786 |
From: Markus Armbruster <armbru@redhat.com>
|
|
|
357786 |
Date: Fri, 31 Aug 2018 14:24:59 +0200
|
|
|
357786 |
Subject: [PATCH 08/29] i386: Fix arch_query_cpu_model_expansion() leak
|
|
|
357786 |
|
|
|
357786 |
RH-Author: Markus Armbruster <armbru@redhat.com>
|
|
|
357786 |
Message-id: <20180831142459.18567-3-armbru@redhat.com>
|
|
|
357786 |
Patchwork-id: 81985
|
|
|
357786 |
O-Subject: [RHEL-7.6 qemu-kvm-rhev PATCH 2/2] i386: Fix arch_query_cpu_model_expansion() leak
|
|
|
357786 |
Bugzilla: 1624390
|
|
|
357786 |
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
357786 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
357786 |
RH-Acked-by: Auger Eric <eric.auger@redhat.com>
|
|
|
357786 |
|
|
|
357786 |
From: Eduardo Habkost <ehabkost@redhat.com>
|
|
|
357786 |
|
|
|
357786 |
Reported by Coverity:
|
|
|
357786 |
|
|
|
357786 |
Error: RESOURCE_LEAK (CWE-772): [#def439]
|
|
|
357786 |
qemu-2.12.0/target/i386/cpu.c:3179: alloc_fn: Storage is returned from allocation function "qdict_new".
|
|
|
357786 |
qemu-2.12.0/qobject/qdict.c:34:5: alloc_fn: Storage is returned from allocation function "g_malloc0".
|
|
|
357786 |
qemu-2.12.0/qobject/qdict.c:34:5: var_assign: Assigning: "qdict" = "g_malloc0(4120UL)".
|
|
|
357786 |
qemu-2.12.0/qobject/qdict.c:37:5: return_alloc: Returning allocated memory "qdict".
|
|
|
357786 |
qemu-2.12.0/target/i386/cpu.c:3179: var_assign: Assigning: "props" = storage returned from "qdict_new()".
|
|
|
357786 |
qemu-2.12.0/target/i386/cpu.c:3217: leaked_storage: Variable "props" going out of scope leaks the storage it points to.
|
|
|
357786 |
|
|
|
357786 |
This was introduced by commit b8097deb359b ("i386: Improve
|
|
|
357786 |
query-cpu-model-expansion full mode").
|
|
|
357786 |
|
|
|
357786 |
The leak is only theoretical: if ret->model->props is set to
|
|
|
357786 |
props, the qapi_free_CpuModelExpansionInfo() call will free props
|
|
|
357786 |
too in case of errors. The only way for this to not happen is if
|
|
|
357786 |
we enter the default branch of the switch statement, which would
|
|
|
357786 |
never happen because all CpuModelExpansionType values are being
|
|
|
357786 |
handled.
|
|
|
357786 |
|
|
|
357786 |
It's still worth to change this to make the allocation logic
|
|
|
357786 |
easier to follow and make the Coverity error go away. To make
|
|
|
357786 |
everything simpler, initialize ret->model and ret->model->props
|
|
|
357786 |
earlier in the function.
|
|
|
357786 |
|
|
|
357786 |
While at it, remove redundant check for !prop because prop is
|
|
|
357786 |
always initialized at the beginning of the function.
|
|
|
357786 |
|
|
|
357786 |
Fixes: b8097deb359bbbd92592b9670adfe9e245b2d0bd
|
|
|
357786 |
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
|
|
|
357786 |
Message-Id: <20180816183509.8231-1-ehabkost@redhat.com>
|
|
|
357786 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
357786 |
(cherry picked from commit e38bf612477fca62b205ebd909b1372a7e45a8c0)
|
|
|
357786 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
357786 |
---
|
|
|
357786 |
target/i386/cpu.c | 9 +++------
|
|
|
357786 |
1 file changed, 3 insertions(+), 6 deletions(-)
|
|
|
357786 |
|
|
|
357786 |
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
|
|
|
357786 |
index e317aaf..6b5acdf 100644
|
|
|
357786 |
--- a/target/i386/cpu.c
|
|
|
357786 |
+++ b/target/i386/cpu.c
|
|
|
357786 |
@@ -3733,6 +3733,9 @@ arch_query_cpu_model_expansion(CpuModelExpansionType type,
|
|
|
357786 |
}
|
|
|
357786 |
|
|
|
357786 |
props = qdict_new();
|
|
|
357786 |
+ ret->model = g_new0(CpuModelInfo, 1);
|
|
|
357786 |
+ ret->model->props = QOBJECT(props);
|
|
|
357786 |
+ ret->model->has_props = true;
|
|
|
357786 |
|
|
|
357786 |
switch (type) {
|
|
|
357786 |
case CPU_MODEL_EXPANSION_TYPE_STATIC:
|
|
|
357786 |
@@ -3753,15 +3756,9 @@ arch_query_cpu_model_expansion(CpuModelExpansionType type,
|
|
|
357786 |
goto out;
|
|
|
357786 |
}
|
|
|
357786 |
|
|
|
357786 |
- if (!props) {
|
|
|
357786 |
- props = qdict_new();
|
|
|
357786 |
- }
|
|
|
357786 |
x86_cpu_to_dict(xc, props);
|
|
|
357786 |
|
|
|
357786 |
- ret->model = g_new0(CpuModelInfo, 1);
|
|
|
357786 |
ret->model->name = g_strdup(base_name);
|
|
|
357786 |
- ret->model->props = QOBJECT(props);
|
|
|
357786 |
- ret->model->has_props = true;
|
|
|
357786 |
|
|
|
357786 |
out:
|
|
|
357786 |
object_unref(OBJECT(xc));
|
|
|
357786 |
--
|
|
|
357786 |
1.8.3.1
|
|
|
357786 |
|