[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 41/47] chardev/wctable: don't free the instance in wctablet_chr_f
From: |
Michael Roth |
Subject: |
[PATCH 41/47] chardev/wctable: don't free the instance in wctablet_chr_finalize |
Date: |
Tue, 14 Dec 2021 18:01:19 -0600 |
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
Object is supposed to be freed by invoking obj->free, and not
obj->instance_finalize. This would lead to use-after-free followed by
double free in object_unref/object_finalize.
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20211117142349.836279-1-d-tatianin@yandex-team.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit fdc6e168181d06391711171b7c409b34f2981ced)
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
chardev/wctablet.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index 95e005f5a5..e8b292c43c 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -320,7 +320,6 @@ static void wctablet_chr_finalize(Object *obj)
TabletChardev *tablet = WCTABLET_CHARDEV(obj);
qemu_input_handler_unregister(tablet->hs);
- g_free(tablet);
}
static void wctablet_chr_open(Chardev *chr,
--
2.25.1
- [PATCH 32/47] hw: m68k: virt: Add compat machine for 6.1, (continued)
- [PATCH 32/47] hw: m68k: virt: Add compat machine for 6.1, Michael Roth, 2021/12/14
- [PATCH 33/47] rcu: Introduce force_rcu notifier, Michael Roth, 2021/12/14
- [PATCH 34/47] accel/tcg: Register a force_rcu notifier, Michael Roth, 2021/12/14
- [PATCH 35/47] pcie: rename 'native-hotplug' to 'x-native-hotplug', Michael Roth, 2021/12/14
- [PATCH 36/47] virtio: use virtio accessor to access packed descriptor flags, Michael Roth, 2021/12/14
- [PATCH 37/47] virtio: use virtio accessor to access packed event, Michael Roth, 2021/12/14
- [PATCH 38/47] vfio: Fix memory leak of hostwin, Michael Roth, 2021/12/14
- [PATCH 39/47] nbd/server: Don't complain on certain client disconnects, Michael Roth, 2021/12/14
- [PATCH 40/47] hw/nvme: fix buffer overrun in nvme_changed_nslist (CVE-2021-3947), Michael Roth, 2021/12/14
- [PATCH 03/47] virtio-net: fix use after unmap/free for sg, Michael Roth, 2021/12/14
- [PATCH 41/47] chardev/wctable: don't free the instance in wctablet_chr_finalize,
Michael Roth <=
- [PATCH 42/47] hw/block/fdc: Extract blk_create_empty_drive(), Michael Roth, 2021/12/14
- [PATCH 43/47] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196, Michael Roth, 2021/12/14
- [PATCH 44/47] tests/qtest/fdc-test: Add a regression test for CVE-2021-20196, Michael Roth, 2021/12/14
- [PATCH 45/47] virtio-blk: Fix clean up of host notifiers for single MR transaction., Michael Roth, 2021/12/14
- [PATCH 46/47] net: vmxnet3: validate configuration values during activate (CVE-2021-20203), Michael Roth, 2021/12/14
- [PATCH 47/47] e1000: fix tx re-entrancy problem, Michael Roth, 2021/12/14
- [PATCH 04/47] qemu-nbd: Change default cache mode to writeback, Michael Roth, 2021/12/14
- [PATCH 05/47] hmp: Unbreak "change vnc", Michael Roth, 2021/12/14
- [PATCH 06/47] virtio-mem-pci: Fix memory leak when creating MEMORY_DEVICE_SIZE_CHANGE event, Michael Roth, 2021/12/14
- [PATCH 07/47] uas: add stream number sanity checks., Michael Roth, 2021/12/14