From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52106)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <imammedo@redhat.com>) id 1bUUXl-0003rb-Jd
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:55:25 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <imammedo@redhat.com>) id 1bUUXf-0001vB-QO
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:55:16 -0400
Received: from mx1.redhat.com ([209.132.183.28]:34802)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <imammedo@redhat.com>) id 1bUUXf-0001v3-KT
	for qemu-devel@nongnu.org; Tue, 02 Aug 2016 03:55:11 -0400
Received: from int-mx09.intmail.prod.int.phx2.redhat.com
	(int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 932BDC05681D
	for <qemu-devel@nongnu.org>; Tue,  2 Aug 2016 07:55:10 +0000 (UTC)
Date: Tue, 2 Aug 2016 09:55:07 +0200
From: Igor Mammedov <imammedo@redhat.com>
Message-ID: <20160802095507.6055409b@nial.brq.redhat.com>
In-Reply-To: <1470109301-12966-1-git-send-email-famz@redhat.com>
References: <1470109301-12966-1-git-send-email-famz@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] qdev: Fix use after free in
 qdev_init_nofail error path
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Fam Zheng <famz@redhat.com>
Cc: qemu-devel@nongnu.org, jsnow@redhat.com, ehabkost@redhat.com

On Tue,  2 Aug 2016 11:41:41 +0800
Fam Zheng <famz@redhat.com> wrote:

> Since 69382d8b (qdev: Fix object reference leak in case device.realize()
> fails), object_property_set_bool could release the object. The error
> path wants the type name, so hold an reference before realizing it.
> 
> Cc: Igor Mammedov <imammedo@redhat.com>
> Signed-off-by: Fam Zheng <famz@redhat.com>
> ---
>  hw/core/qdev.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/hw/core/qdev.c b/hw/core/qdev.c
> index ee4a083..5783442 100644
> --- a/hw/core/qdev.c
> +++ b/hw/core/qdev.c
> @@ -354,12 +354,14 @@ void qdev_init_nofail(DeviceState *dev)
>  
>      assert(!dev->realized);
>  
> +    object_ref(OBJECT(dev));
>      object_property_set_bool(OBJECT(dev), true, "realized", &err);
>      if (err) {
>          error_reportf_err(err, "Initialization of device %s failed: ",
>                            object_get_typename(OBJECT(dev)));
>          exit(1);
>      }
> +    object_unref(OBJECT(dev));
>  }
>  
>  void qdev_machine_creation_done(void)

I'm not sure that this is the right fix, commit 69382d8b only affects
reference created by realize() itself.
Probably reference counting wrong somewhere else,
for typical device call sequence is following:

 qdev_create() {
    object_new() -> ref == 1
    qdev_set_parent_bus() -> ref == 2
    object_unref() -> ref == 1
 } -> ref == 1
 
 do property settings and other stuff ...

 
 qdev_init_nofail() { called with ref == 1
    object_property_set_bool(true, "realized")
    if error:
          ref == 1
    else:
          ref == 2 (+1 for implicitly assigned parent)
 }