[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [qemu-xen stable-4.16] chardev/wctable: don't free the instance in wctablet_chr_finalize
commit 4658dfcbc09dcc90025604cce64d6fd01952b882 Author: Daniil Tatianin <d-tatianin@xxxxxxxxxxxxxx> AuthorDate: Wed Nov 17 17:23:49 2021 +0300 Commit: Michael Roth <michael.roth@xxxxxxx> CommitDate: Tue Dec 14 14:54:14 2021 -0600 chardev/wctable: don't free the instance in wctablet_chr_finalize Object is supposed to be freed by invoking obj->free, and not obj->instance_finalize. This would lead to use-after-free followed by double free in object_unref/object_finalize. Signed-off-by: Daniil Tatianin <d-tatianin@xxxxxxxxxxxxxx> Reviewed-by: Marc-André Lureau <marcandre.lureau@xxxxxxxxxx> Message-Id: <20211117142349.836279-1-d-tatianin@xxxxxxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> (cherry picked from commit fdc6e168181d06391711171b7c409b34f2981ced) Signed-off-by: Michael Roth <michael.roth@xxxxxxx> --- chardev/wctablet.c | 1 - 1 file changed, 1 deletion(-) diff --git a/chardev/wctablet.c b/chardev/wctablet.c index 95e005f5a5..e8b292c43c 100644 --- a/chardev/wctablet.c +++ b/chardev/wctablet.c @@ -320,7 +320,6 @@ static void wctablet_chr_finalize(Object *obj) TabletChardev *tablet = WCTABLET_CHARDEV(obj); qemu_input_handler_unregister(tablet->hs); - g_free(tablet); } static void wctablet_chr_open(Chardev *chr, -- generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.16
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |