From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40821) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZvqWr-0002YI-7O for qemu-devel@nongnu.org; Mon, 09 Nov 2015 12:46:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZvqWl-0000Lx-Kd for qemu-devel@nongnu.org; Mon, 09 Nov 2015 12:46:53 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42187) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZvqWl-0000Ll-Fw for qemu-devel@nongnu.org; Mon, 09 Nov 2015 12:46:47 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 2D3B38E259 for ; Mon, 9 Nov 2015 17:46:47 +0000 (UTC) From: Markus Armbruster Date: Mon, 9 Nov 2015 18:46:35 +0100 Message-Id: <1447091204-10226-4-git-send-email-armbru@redhat.com> In-Reply-To: <1447091204-10226-1-git-send-email-armbru@redhat.com> References: <1447091204-10226-1-git-send-email-armbru@redhat.com> Subject: [Qemu-devel] [PULL 03/12] qobject: Protect against use-after-free in qobject_decref() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org From: Eric Blake Adding an assertion to qobject_decref() will ensure that a programming error causing use-after-free will result in immediate failure (provided no other thread has started using the memory) instead of silently attempting to wrap refcnt around and leaving the problem to potentially bite later at a harder point to diagnose. Suggested-by: Markus Armbruster Signed-off-by: Eric Blake Message-Id: <1446791754-23823-4-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster --- include/qapi/qmp/qobject.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h index c856f55..4b96ed5 100644 --- a/include/qapi/qmp/qobject.h +++ b/include/qapi/qmp/qobject.h @@ -90,6 +90,7 @@ static inline void qobject_incref(QObject *obj) */ static inline void qobject_decref(QObject *obj) { + assert(!obj || obj->refcnt); if (obj && --obj->refcnt == 0) { assert(obj->type != NULL); assert(obj->type->destroy != NULL); -- 2.4.3