On Sat, Mar 28, 2020 at 08:57:04AM +0800, Pan Nengyuan wrote: > virtio_vqs forgot to free on the error path in realize(). Fix that. > > The asan stack: > Direct leak of 14336 byte(s) in 1 object(s) allocated from: > #0 0x7f58b93fd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) > #1 0x7f58b858249d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) > #2 0x5562cc627f49 in virtio_add_queue > /mnt/sdb/qemu/hw/virtio/virtio.c:2413 > #3 0x5562cc4b524a in virtio_blk_device_realize > /mnt/sdb/qemu/hw/block/virtio-blk.c:1202 > #4 0x5562cc613050 in virtio_device_realize > /mnt/sdb/qemu/hw/virtio/virtio.c:3615 > #5 0x5562ccb7a568 in device_set_realized /mnt/sdb/qemu/hw/core/qdev.c:891 > #6 0x5562cd39cd45 in property_set_bool /mnt/sdb/qemu/qom/object.c:2238 > > Reported-by: Euler Robot <euler.ro...@huawei.com> > Signed-off-by: Pan Nengyuan <pannengy...@huawei.com> > Reviewed-by: Stefano Garzarella <sgarz...@redhat.com> > --- > v2->v1: > - Fix incorrect free in v1, it will cause a uaf. > --- > Cc: Stefan Hajnoczi <stefa...@redhat.com> > Cc: Kevin Wolf <kw...@redhat.com> > Cc: Max Reitz <mre...@redhat.com> > Cc: qemu-bl...@nongnu.org > --- > hw/block/virtio-blk.c | 3 +++ > 1 file changed, 3 insertions(+)
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
signature.asc
Description: PGP signature
