9ae3a8
From 26c346739c8772521b68e4763321d7bdfc49efd4 Mon Sep 17 00:00:00 2001
9ae3a8
From: Markus Armbruster <armbru@redhat.com>
9ae3a8
Date: Fri, 17 Jan 2014 17:07:54 +0100
9ae3a8
Subject: [PATCH 04/11] qdev-monitor: Fix crash when device_add is called with abstract driver
9ae3a8
MIME-Version: 1.0
9ae3a8
Content-Type: text/plain; charset=UTF-8
9ae3a8
Content-Transfer-Encoding: 8bit
9ae3a8
9ae3a8
RH-Author: Markus Armbruster <armbru@redhat.com>
9ae3a8
Message-id: <1389978479-30595-5-git-send-email-armbru@redhat.com>
9ae3a8
Patchwork-id: 56787
9ae3a8
O-Subject: [PATCH 7.0 qemu-kvm 4/9] qdev-monitor: Fix crash when device_add is called with abstract driver
9ae3a8
Bugzilla: 669524
9ae3a8
RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
9ae3a8
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
9ae3a8
RH-Acked-by: Marcel Apfelbaum <marcel.a@redhat.com>
9ae3a8
9ae3a8
From: Igor Mammedov <imammedo@redhat.com>
9ae3a8
9ae3a8
User is able to crash running QEMU when following monitor
9ae3a8
command is called:
9ae3a8
9ae3a8
 device_add intel-hda-generic
9ae3a8
9ae3a8
Crash is caused by assertion in object_initialize_with_type()
9ae3a8
when type is abstract.
9ae3a8
9ae3a8
Checking if type is abstract before instance is created in
9ae3a8
qdev_device_add() allows to prevent crash on incorrect user input.
9ae3a8
9ae3a8
Cc: qemu-stable@nongnu.org
9ae3a8
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
9ae3a8
Signed-off-by: Andreas Färber <afaerber@suse.de>
9ae3a8
(cherry picked from commit 2fa4e56d88aa0039062bbc7f9a88e9f90c77ed94)
9ae3a8
Signed-off-by: Markus Armbruster <armbru@redhat.com>
9ae3a8
---
9ae3a8
 qdev-monitor.c | 6 ++++++
9ae3a8
 1 file changed, 6 insertions(+)
9ae3a8
9ae3a8
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
---
9ae3a8
 qdev-monitor.c |    6 ++++++
9ae3a8
 1 files changed, 6 insertions(+), 0 deletions(-)
9ae3a8
9ae3a8
diff --git a/qdev-monitor.c b/qdev-monitor.c
9ae3a8
index 5b45d02..f313a94 100644
9ae3a8
--- a/qdev-monitor.c
9ae3a8
+++ b/qdev-monitor.c
9ae3a8
@@ -482,6 +482,12 @@ DeviceState *qdev_device_add(QemuOpts *opts)
9ae3a8
         return NULL;
9ae3a8
     }
9ae3a8
 
9ae3a8
+    if (object_class_is_abstract(oc)) {
9ae3a8
+        qerror_report(QERR_INVALID_PARAMETER_VALUE, "driver",
9ae3a8
+                      "non-abstract device type");
9ae3a8
+        return NULL;
9ae3a8
+    }
9ae3a8
+
9ae3a8
     dc = DEVICE_CLASS(oc);
9ae3a8
 
9ae3a8
     /* find bus */
9ae3a8
-- 
9ae3a8
1.7.1
9ae3a8