This is to avoid objects initializing beyond allocated memory.
Inspired-by: Peter Maydell <peter.mayd...@linaro.org>
Signed-off-by: Andreas Färber <afaer...@suse.de>
---
hw/core/qdev.c | 2 +-
hw/dma/xilinx_axidma.c | 6 ++++--
hw/intc/xics.c | 2 +-
hw/misc/macio/macio.c | 13 +++++++------
hw/net/xilinx_axienet.c | 6 ++++--
hw/pci-host/prep.c | 2 +-
hw/pci-host/q35.c | 2 +-
hw/pci-host/versatile.c | 2 +-
hw/s390x/s390-virtio-bus.c | 12 ++++++------
hw/s390x/virtio-ccw.c | 14 +++++++-------
hw/virtio/virtio-pci.c | 16 ++++++++--------
include/qom/object.h | 6 ++++--
qom/object.c | 9 +++++----
13 files changed, 50 insertions(+), 42 deletions(-)
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 81874da..533f6dd 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -473,7 +473,7 @@ static void bus_unparent(Object *obj)
void qbus_create_inplace(void *bus, size_t size, const char *typename,
DeviceState *parent, const char *name)
{
- object_initialize(bus, typename);
+ object_initialize(bus, size, typename);
qbus_realize(bus, parent, name);
}
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index a48e3ba..1e6a88d 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -578,8 +578,10 @@ static void xilinx_axidma_init(Object *obj)
(Object **) &s->tx_control_dev, &errp);
assert_no_error(errp);
- object_initialize(&s->rx_data_dev, TYPE_XILINX_AXI_DMA_DATA_STREAM);
- object_initialize(&s->rx_control_dev, TYPE_XILINX_AXI_DMA_CONTROL_STREAM);
+ object_initialize(&s->rx_data_dev, sizeof(s->rx_data_dev),
+ TYPE_XILINX_AXI_DMA_DATA_STREAM);
+ object_initialize(&s->rx_control_dev, sizeof(s->rx_control_dev),
+ TYPE_XILINX_AXI_DMA_CONTROL_STREAM);
object_property_add_child(OBJECT(s), "axistream-connected-target",
(Object *)&s->rx_data_dev, &errp);
assert_no_error(errp);
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 6b3c071..b96b041 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -650,7 +650,7 @@ static void xics_realize(DeviceState *dev, Error **errp)
icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
for (i = 0; i < icp->nr_servers; i++) {
char buffer[32];
- object_initialize(&icp->ss[i], TYPE_ICP);
+ object_initialize(&icp->ss[i], sizeof(icp->ss[i]), TYPE_ICP);
snprintf(buffer, sizeof(buffer), "icp[%d]", i);
object_property_add_child(OBJECT(icp), buffer, OBJECT(&icp->ss[i]),
NULL);
qdev_init_nofail(DEVICE(&icp->ss[i]));
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index c0d0bf7..1bee3d8 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -202,11 +202,12 @@ static int macio_oldworld_initfn(PCIDevice *d)
return 0;
}
-static void macio_init_ide(MacIOState *s, MACIOIDEState *ide, int index)
+static void macio_init_ide(MacIOState *s, MACIOIDEState *ide, size_t ide_size,
+ int index)
{
gchar *name;
- object_initialize(ide, TYPE_MACIO_IDE);
+ object_initialize(ide, ide_size, TYPE_MACIO_IDE);
qdev_set_parent_bus(DEVICE(ide), sysbus_get_default());
memory_region_add_subregion(&s->bar, 0x1f000 + ((index + 1) * 0x1000),
&ide->mem);
@@ -224,13 +225,13 @@ static void macio_oldworld_init(Object *obj)
qdev_init_gpio_out(DEVICE(obj), os->irqs, ARRAY_SIZE(os->irqs));
- object_initialize(&os->nvram, TYPE_MACIO_NVRAM);
+ object_initialize(&os->nvram, sizeof(os->nvram), TYPE_MACIO_NVRAM);
dev = DEVICE(&os->nvram);
qdev_prop_set_uint32(dev, "size", 0x2000);
qdev_prop_set_uint32(dev, "it_shift", 4);
for (i = 0; i < 2; i++) {
- macio_init_ide(s, &os->ide[i], i);
+ macio_init_ide(s, &os->ide[i], sizeof(os->ide[i]), i);
}
}
@@ -310,7 +311,7 @@ static void macio_newworld_init(Object *obj)
qdev_init_gpio_out(DEVICE(obj), ns->irqs, ARRAY_SIZE(ns->irqs));
for (i = 0; i < 2; i++) {
- macio_init_ide(s, &ns->ide[i], i);
+ macio_init_ide(s, &ns->ide[i], sizeof(ns->ide[i]), i);
}
}
@@ -321,7 +322,7 @@ static void macio_instance_init(Object *obj)
memory_region_init(&s->bar, NULL, "macio", 0x80000);
- object_initialize(&s->cuda, TYPE_CUDA);
+ object_initialize(&s->cuda, sizeof(s->cuda), TYPE_CUDA);
qdev_set_parent_bus(DEVICE(&s->cuda), sysbus_get_default());
object_property_add_child(obj, "cuda", OBJECT(&s->cuda), NULL);
diff --git a/hw/net/xilinx_axienet.c b/hw/net/xilinx_axienet.c
index f173429..3eb7715 100644
--- a/hw/net/xilinx_axienet.c
+++ b/hw/net/xilinx_axienet.c
@@ -990,8 +990,10 @@ static void xilinx_enet_init(Object *obj)
(Object **) &s->tx_control_dev, &errp);
assert_no_error(errp);
- object_initialize(&s->rx_data_dev, TYPE_XILINX_AXI_ENET_DATA_STREAM);
- object_initialize(&s->rx_control_dev, TYPE_XILINX_AXI_ENET_CONTROL_STREAM);
+ object_initialize(&s->rx_data_dev, sizeof(s->rx_data_dev),
+ TYPE_XILINX_AXI_ENET_DATA_STREAM);
+ object_initialize(&s->rx_control_dev, sizeof(s->rx_control_dev),
+ TYPE_XILINX_AXI_ENET_CONTROL_STREAM);
object_property_add_child(OBJECT(s), "axistream-connected-target",
(Object *)&s->rx_data_dev, &errp);
assert_no_error(errp);
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index a62236b..0e71fdb 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -159,7 +159,7 @@ static void raven_pcihost_initfn(Object *obj)
address_space_mem, address_space_io, 0, TYPE_PCI_BUS);
h->bus = &s->pci_bus;
- object_initialize(&s->pci_dev, TYPE_RAVEN_PCI_DEVICE);
+ object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_RAVEN_PCI_DEVICE);
pci_dev = DEVICE(&s->pci_dev);
qdev_set_parent_bus(pci_dev, BUS(&s->pci_bus));
object_property_set_int(OBJECT(&s->pci_dev), PCI_DEVFN(0, 0), "addr",
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 12314d8..e7d9712 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -133,7 +133,7 @@ static void q35_host_initfn(Object *obj)
memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops, phb,
"pci-conf-data", 4);
- object_initialize(&s->mch, TYPE_MCH_PCI_DEVICE);
+ object_initialize(&s->mch, sizeof(s->mch), TYPE_MCH_PCI_DEVICE);
object_property_add_child(OBJECT(s), "mch", OBJECT(&s->mch), NULL);
qdev_prop_set_uint32(DEVICE(&s->mch), "addr", PCI_DEVFN(0, 0));
qdev_prop_set_bit(DEVICE(&s->mch), "multifunction", false);
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 4b9359c..6b28929 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -389,7 +389,7 @@ static void pci_vpb_init(Object *obj)
PCI_DEVFN(11, 0), TYPE_PCI_BUS);
h->bus = &s->pci_bus;
- object_initialize(&s->pci_dev, TYPE_VERSATILE_PCI_HOST);
+ object_initialize(&s->pci_dev, sizeof(s->pci_dev),
TYPE_VERSATILE_PCI_HOST);
qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
/* Window sizes for VersatilePB; realview_pci's init will override */
diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index e95b831..9cb8b91 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -171,7 +171,7 @@ static int s390_virtio_net_init(VirtIOS390Device *s390_dev)
static void s390_virtio_net_instance_init(Object *obj)
{
VirtIONetS390 *dev = VIRTIO_NET_S390(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_NET);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_NET);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -190,7 +190,7 @@ static int s390_virtio_blk_init(VirtIOS390Device *s390_dev)
static void s390_virtio_blk_instance_init(Object *obj)
{
VirtIOBlkS390 *dev = VIRTIO_BLK_S390(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_BLK);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_BLK);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -231,7 +231,7 @@ static int s390_virtio_serial_init(VirtIOS390Device
*s390_dev)
static void s390_virtio_serial_instance_init(Object *obj)
{
VirtIOSerialS390 *dev = VIRTIO_SERIAL_S390(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SERIAL);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SERIAL);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -263,7 +263,7 @@ static int s390_virtio_scsi_init(VirtIOS390Device *s390_dev)
static void s390_virtio_scsi_instance_init(Object *obj)
{
VirtIOSCSIS390 *dev = VIRTIO_SCSI_S390(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -284,7 +284,7 @@ static int s390_vhost_scsi_init(VirtIOS390Device *s390_dev)
static void s390_vhost_scsi_instance_init(Object *obj)
{
VHostSCSIS390 *dev = VHOST_SCSI_S390(obj);
- object_initialize(&dev->vdev, TYPE_VHOST_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VHOST_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
#endif
@@ -310,7 +310,7 @@ static int s390_virtio_rng_init(VirtIOS390Device *s390_dev)
static void s390_virtio_rng_instance_init(Object *obj)
{
VirtIORNGS390 *dev = VIRTIO_RNG_S390(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_RNG);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_RNG);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
object_property_add_link(obj, "rng", TYPE_RNG_BACKEND,
(Object **)&dev->vdev.conf.rng, NULL);
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index cf7075e..ea57b3e 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -660,7 +660,7 @@ static int virtio_ccw_net_init(VirtioCcwDevice *ccw_dev)
static void virtio_ccw_net_instance_init(Object *obj)
{
VirtIONetCcw *dev = VIRTIO_NET_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_NET);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_NET);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -680,7 +680,7 @@ static int virtio_ccw_blk_init(VirtioCcwDevice *ccw_dev)
static void virtio_ccw_blk_instance_init(Object *obj)
{
VirtIOBlkCcw *dev = VIRTIO_BLK_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_BLK);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_BLK);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -713,7 +713,7 @@ static int virtio_ccw_serial_init(VirtioCcwDevice *ccw_dev)
static void virtio_ccw_serial_instance_init(Object *obj)
{
VirtioSerialCcw *dev = VIRTIO_SERIAL_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SERIAL);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SERIAL);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -759,7 +759,7 @@ static void balloon_ccw_stats_set_poll_interval(Object
*obj, struct Visitor *v,
static void virtio_ccw_balloon_instance_init(Object *obj)
{
VirtIOBalloonCcw *dev = VIRTIO_BALLOON_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_BALLOON);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_BALLOON);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
object_property_add(obj, "guest-stats", "guest statistics",
@@ -799,7 +799,7 @@ static int virtio_ccw_scsi_init(VirtioCcwDevice *ccw_dev)
static void virtio_ccw_scsi_instance_init(Object *obj)
{
VirtIOSCSICcw *dev = VIRTIO_SCSI_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -820,7 +820,7 @@ static int vhost_ccw_scsi_init(VirtioCcwDevice *ccw_dev)
static void vhost_ccw_scsi_instance_init(Object *obj)
{
VHostSCSICcw *dev = VHOST_SCSI_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VHOST_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VHOST_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
#endif
@@ -1171,7 +1171,7 @@ static const TypeInfo vhost_ccw_scsi = {
static void virtio_ccw_rng_instance_init(Object *obj)
{
VirtIORNGCcw *dev = VIRTIO_RNG_CCW(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_RNG);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_RNG);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
object_property_add_link(obj, "rng", TYPE_RNG_BACKEND,
(Object **)&dev->vdev.conf.rng, NULL);
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index a9a1893..811adb3 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -919,7 +919,7 @@ static void virtio_9p_pci_class_init(ObjectClass *klass,
void *data)
static void virtio_9p_pci_instance_init(Object *obj)
{
V9fsPCIState *dev = VIRTIO_9P_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_9P);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_9P);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1079,7 +1079,7 @@ static void virtio_blk_pci_class_init(ObjectClass *klass,
void *data)
static void virtio_blk_pci_instance_init(Object *obj)
{
VirtIOBlkPCI *dev = VIRTIO_BLK_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_BLK);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_BLK);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1149,7 +1149,7 @@ static void virtio_scsi_pci_class_init(ObjectClass
*klass, void *data)
static void virtio_scsi_pci_instance_init(Object *obj)
{
VirtIOSCSIPCI *dev = VIRTIO_SCSI_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1206,7 +1206,7 @@ static void vhost_scsi_pci_class_init(ObjectClass *klass,
void *data)
static void vhost_scsi_pci_instance_init(Object *obj)
{
VHostSCSIPCI *dev = VHOST_SCSI_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VHOST_SCSI);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VHOST_SCSI);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1287,7 +1287,7 @@ static void virtio_balloon_pci_class_init(ObjectClass
*klass, void *data)
static void virtio_balloon_pci_instance_init(Object *obj)
{
VirtIOBalloonPCI *dev = VIRTIO_BALLOON_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_BALLOON);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_BALLOON);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
object_property_add(obj, "guest-stats", "guest statistics",
@@ -1373,7 +1373,7 @@ static void virtio_serial_pci_class_init(ObjectClass
*klass, void *data)
static void virtio_serial_pci_instance_init(Object *obj)
{
VirtIOSerialPCI *dev = VIRTIO_SERIAL_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_SERIAL);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_SERIAL);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1432,7 +1432,7 @@ static void virtio_net_pci_class_init(ObjectClass *klass,
void *data)
static void virtio_net_pci_instance_init(Object *obj)
{
VirtIONetPCI *dev = VIRTIO_NET_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_NET);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_NET);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
}
@@ -1488,7 +1488,7 @@ static void virtio_rng_pci_class_init(ObjectClass *klass,
void *data)
static void virtio_rng_initfn(Object *obj)
{
VirtIORngPCI *dev = VIRTIO_RNG_PCI(obj);
- object_initialize(&dev->vdev, TYPE_VIRTIO_RNG);
+ object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_RNG);
object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev),
NULL);
object_property_add_link(obj, "rng", TYPE_RNG_BACKEND,
(Object **)&dev->vdev.conf.rng, NULL);
diff --git a/include/qom/object.h b/include/qom/object.h
index c463ced..1a7b71a 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -586,24 +586,26 @@ Object *object_new_with_type(Type type);
/**
* object_initialize_with_type:
* @data: A pointer to the memory to be used for the object.
+ * @size: The maximum size available at @data for the object.
* @type: The type of the object to instantiate.
*
* This function will initialize an object. The memory for the object should
* have already been allocated. The returned object has a reference count of
1,
* and will be finalized when the last reference is dropped.
*/
-void object_initialize_with_type(void *data, Type type);
+void object_initialize_with_type(void *data, size_t size, Type type);
/**
* object_initialize:
* @obj: A pointer to the memory to be used for the object.
+ * @size: The maximum size available at @obj for the object.
* @typename: The name of the type of the object to instantiate.
*
* This function will initialize an object. The memory for the object should
* have already been allocated. The returned object has a reference count of
1,
* and will be finalized when the last reference is dropped.
*/
-void object_initialize(void *obj, const char *typename);
+void object_initialize(void *obj, size_t size, const char *typename);
/**
* object_dynamic_cast:
diff --git a/qom/object.c b/qom/object.c
index 74fd241..e90e382 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -311,7 +311,7 @@ static void object_post_init_with_type(Object *obj,
TypeImpl *ti)
}
}
-void object_initialize_with_type(void *data, TypeImpl *type)
+void object_initialize_with_type(void *data, size_t size, TypeImpl *type)
{
Object *obj = data;
@@ -320,6 +320,7 @@ void object_initialize_with_type(void *data, TypeImpl *type)
g_assert(type->instance_size >= sizeof(Object));
g_assert(type->abstract == false);
+ g_assert(size >= type->instance_size);