From e446a1eb5e358e47193a03a7a5f3ce9b8b5e36ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 19 Feb 2018 18:27:15 +0100
Subject: [PATCH 1/2] 9p: v9fs_path_copy() readability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
lhs/rhs doesn't tell much about how argument are handled, dst/src is
and const arguments is clearer in my mind. Use g_memdup() while at it.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
---
hw/9pfs/9p.c | 9 ++++-----
hw/9pfs/9p.h | 2 +-
2 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 85a1ed8171..48fa48e720 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -190,12 +190,11 @@ v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...)
va_end(ap);
}
-void v9fs_path_copy(V9fsPath *lhs, V9fsPath *rhs)
+void v9fs_path_copy(V9fsPath *dst, const V9fsPath *src)
{
- v9fs_path_free(lhs);
- lhs->data = g_malloc(rhs->size);
- memcpy(lhs->data, rhs->data, rhs->size);
- lhs->size = rhs->size;
+ v9fs_path_free(dst);
+ dst->size = src->size;
+ dst->data = g_memdup(src->data, src->size);
}
int v9fs_name_to_path(V9fsState *s, V9fsPath *dirpath,
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index 5ced427d86..bad8ee719c 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -343,7 +343,7 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu);
void v9fs_path_init(V9fsPath *path);
void v9fs_path_free(V9fsPath *path);
void v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...);
-void v9fs_path_copy(V9fsPath *lhs, V9fsPath *rhs);
+void v9fs_path_copy(V9fsPath *dst, const V9fsPath *src);
int v9fs_name_to_path(V9fsState *s, V9fsPath *dirpath,
const char *name, V9fsPath *path);
int v9fs_device_realize_common(V9fsState *s, const V9fsTransport *t,
From 6ce7177ae2e547999ef9e6f467415963991e28da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 19 Feb 2018 18:27:15 +0100
Subject: [PATCH 2/2] 9p: fix leak in synth_name_to_path()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Leak found thanks to ASAN:
Direct leak of 8 byte(s) in 1 object(s) allocated from:
#0 0x55995789ac90 in __interceptor_malloc (/home/elmarco/src/qemu/build/x86_64-softmmu/qemu-system-x86_64+0x1510c90)
#1 0x7f0a91190f0c in g_malloc /home/elmarco/src/gnome/glib/builddir/../glib/gmem.c:94
#2 0x5599580a281c in v9fs_path_copy /home/elmarco/src/qemu/hw/9pfs/9p.c:196:17
#3 0x559958f9ec5d in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:116:9
#4 0x7f0a8766ebbf (/lib64/libc.so.6+0x50bbf)
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
---
hw/9pfs/9p-synth.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index 18082dffe8..54239c9bbf 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -495,6 +495,7 @@ static int synth_name_to_path(FsContext *ctx, V9fsPath *dir_path,
}
out:
/* Copy the node pointer to fid */
+ g_free(target->data);
target->data = g_memdup(&node, sizeof(void *));
target->size = sizeof(void *);
return 0;