ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hw/display/virtio-gpu: Fix memory leak (CID 1453811) 

To avoid leaking memory on the error path, reorder the
code as:
- check the parameters first
- check resource already existing
- finally allocate memory

Reported-by: Coverity (CID 1453811: RESOURCE_LEAK)
Fixes: e0933d91b1 ("virtio-gpu: Add virtio_gpu_resource_create_blob")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210531101928.1662732-1-philmd@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Philippe Mathieu-Daudé 2021-05-31 12:19:28 +02:00 committed by Gerd Hoffmann
parent e77c8b8b8e
commit dc2deaba48
1 changed files with 11 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
hw/display/virtio-gpu.c
View File

@ -340,8 +340,15 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g,
return; return;
} }
res = virtio_gpu_find_resource(g, cblob.resource_id); if (cblob.blob_mem != VIRTIO_GPU_BLOB_MEM_GUEST &&
if (res) { cblob.blob_flags != VIRTIO_GPU_BLOB_FLAG_USE_SHAREABLE) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid memory type\n",
__func__);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
return;
}
if (virtio_gpu_find_resource(g, cblob.resource_id)) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n", qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n",
__func__, cblob.resource_id); __func__, cblob.resource_id);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
@ -352,25 +359,12 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g,
res->resource_id = cblob.resource_id; res->resource_id = cblob.resource_id;
res->blob_size = cblob.size; res->blob_size = cblob.size;
if (cblob.blob_mem != VIRTIO_GPU_BLOB_MEM_GUEST &&
cblob.blob_flags != VIRTIO_GPU_BLOB_FLAG_USE_SHAREABLE) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid memory type\n",
__func__);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
g_free(res);
return;
}
if (res->iov) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
return;
}
ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob), ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob),
cmd, &res->addrs, &res->iov, cmd, &res->addrs, &res->iov,
&res->iov_cnt); &res->iov_cnt);
if (ret != 0) { if (ret != 0 || res->iov) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
g_free(res);
return; return;
} }