From 32cd6550f7a6c8a621798c8b249eae2597db04ea Mon Sep 17 00:00:00 2001 From: zhangjixiang Date: Sun, 25 Feb 2018 09:47:51 +0800 Subject: [PATCH 1/2] HMP: Initialize err before using When bdrv_snapshot_delete return fail, the errp will not be assigned a valid value in error_propagate as errp didn't be initialized in hmp_delvm, then error_reportf_err will use an uninitialized value(call by hmp_delvm), and qemu crash. Signed-off-by: zhangjixiang Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Dr. David Alan Gilbert --- hmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hmp.c b/hmp.c index ba9e299ee2..fd13d5b56a 100644 --- a/hmp.c +++ b/hmp.c @@ -1321,7 +1321,7 @@ void hmp_savevm(Monitor *mon, const QDict *qdict) void hmp_delvm(Monitor *mon, const QDict *qdict) { BlockDriverState *bs; - Error *err; + Error *err = NULL; const char *name = qdict_get_str(qdict, "name"); if (bdrv_all_delete_snapshot(name, &bs, &err) < 0) { From 95372184b7acdfd82ee748b6f0c6df1d839982ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Mon, 19 Mar 2018 18:58:23 +0100 Subject: [PATCH 2/2] hmp: free sev info MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found thanks to ASAN: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7efe20417a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38) #1 0x7efe1f7b2f75 in g_malloc0 ../glib/gmem.c:124 #2 0x7efe1f7b3249 in g_malloc0_n ../glib/gmem.c:355 #3 0x558272879162 in sev_get_info /home/elmarco/src/qemu/target/i386/sev.c:414 #4 0x55827285113b in hmp_info_sev /home/elmarco/src/qemu/target/i386/monitor.c:684 #5 0x5582724043b8 in handle_hmp_command /home/elmarco/src/qemu/monitor.c:3333 Fixes: 63036314 Signed-off-by: Marc-André Lureau Message-Id: <20180319175823.22111-1-marcandre.lureau@redhat.com> Reviewed-by: Eric Blake Signed-off-by: Dr. David Alan Gilbert --- target/i386/monitor.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 011419eba2..a890b3c2ab 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -696,6 +696,8 @@ void hmp_info_sev(Monitor *mon, const QDict *qdict) } else { monitor_printf(mon, "SEV is not enabled\n"); } + + qapi_free_SevInfo(info); } SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp)