From 418c69813f027cb1408aa2759022f5ca170a8c8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 26 Jul 2017 11:38:17 -0600 Subject: [PATCH 1/2] vfio/platform: fix use of freed memory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit free the data _after_ using it. hw/vfio/platform.c:126:29: warning: Use of memory after it is freed qemu_set_fd_handler(*pfd, NULL, NULL, NULL); ^~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Paolo Bonzini Signed-off-by: Alex Williamson --- hw/vfio/platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c index 7c09deda61..da84abf4fc 100644 --- a/hw/vfio/platform.c +++ b/hw/vfio/platform.c @@ -120,11 +120,11 @@ static int vfio_set_trigger_eventfd(VFIOINTp *intp, *pfd = event_notifier_get_fd(intp->interrupt); qemu_set_fd_handler(*pfd, (IOHandler *)handler, NULL, intp); ret = ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set); - g_free(irq_set); if (ret < 0) { error_report("vfio: Failed to set trigger eventfd: %m"); qemu_set_fd_handler(*pfd, NULL, NULL, NULL); } + g_free(irq_set); return ret; } From 96d2c2c57452f8b6bc3decae71435e7230f3432e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 26 Jul 2017 11:38:18 -0600 Subject: [PATCH 2/2] vfio/pci: fix use of freed memory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hw/vfio/pci.c:308:29: warning: Use of memory after it is freed qemu_set_fd_handler(*pfd, NULL, NULL, vdev); ^~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Paolo Bonzini Signed-off-by: Alex Williamson --- hw/vfio/pci.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d4051cb951..31e1edf447 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -257,7 +257,7 @@ static void vfio_intx_update(PCIDevice *pdev) static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp) { uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1); - int ret, argsz; + int ret, argsz, retval = 0; struct vfio_irq_set *irq_set; int32_t *pfd; Error *err = NULL; @@ -302,12 +302,12 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp) qemu_set_fd_handler(*pfd, vfio_intx_interrupt, NULL, vdev); ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set); - g_free(irq_set); if (ret) { error_setg_errno(errp, -ret, "failed to setup INTx fd"); qemu_set_fd_handler(*pfd, NULL, NULL, vdev); event_notifier_cleanup(&vdev->intx.interrupt); - return -errno; + retval = -errno; + goto cleanup; } vfio_intx_enable_kvm(vdev, &err); @@ -319,7 +319,10 @@ static int vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp) trace_vfio_intx_enable(vdev->vbasedev.name); - return 0; +cleanup: + g_free(irq_set); + + return retval; } static void vfio_intx_disable(VFIOPCIDevice *vdev)