No description
Find a file
Peter Maydell e4a1b308b2 hw/pci-host/dino: Don't call pci_register_root_bus() in init
In the dino PCI host bridge device, we call pci_register_root_bus()
in the device's instance_init. This is a problem for two reasons
 * the PCI bridge is then available to the rest of the simulation
   (e.g. via pci_qdev_find_device()), even though it hasn't
   yet been realized
 * we do not attempt to unregister in an instance_deinit,
   which means that if you go through an instance_init -> deinit
   lifecycle the freed memory for the host-bridge device is
   left on the pci_host_bridges list

ASAN reports the resulting use-after-free:

==1771223==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000018f80 at pc 0x5b4b9d3369b5 bp 0x7ffd01929980 sp 0x7ffd01929978
WRITE of size 8 at 0x527000018f80 thread T0
    #0 0x5b4b9d3369b4 in pci_host_bus_register /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:608:5
    #1 0x5b4b9d321566 in pci_root_bus_internal_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:677:5
    #2 0x5b4b9d3215e0 in pci_root_bus_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:706:5
    #3 0x5b4b9d321fe5 in pci_register_root_bus /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:751:11
    #4 0x5b4b9d390521 in dino_pcihost_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci-host/dino.c:473:16

0x527000018f80 is located 1664 bytes inside of 12384-byte region [0x527000018900,0x52700001b960)
freed by thread T0 here:
    #0 0x5b4b9cab185a in free (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17ad85a) (BuildId: ca496bb2e4fc750ebd289b448bad8d99c0ecd140)
    #1 0x5b4b9e3ee723 in object_finalize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:734:9
    #2 0x5b4b9e3e69db in object_unref /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:1232:9
    #3 0x5b4b9ea6173c in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:237:5
    #4 0x5b4b9ec4e0f3 in qmp_marshal_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qapi/qapi-commands-qdev.c:65:14

previously allocated by thread T0 here:
    #0 0x5b4b9cab1af3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17adaf3) (BuildId: ca496bb2e4fc750ebd289b448bad8d99c0ecd140)
    #1 0x799d8270eb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5b4b9e3e75fc in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:767:15
    #3 0x5b4b9e3e7409 in object_new_with_class /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:782:12
    #4 0x5b4b9ea609a5 in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:206:11

where we allocated one instance of the dino device, put it on the
list, freed it, and then trying to allocate a second instance touches
the freed memory on the pci_host_bridges list.

Fix this by deferring all the setup of memory regions and registering
the PCI bridge to the device's realize method.  This brings it into
line with almost all other PCI host bridges, which call
pci_register_root_bus() in realize.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3118
Fixes: 63901b6cc4 ("dino: move PCI bus initialisation to dino_pcihost_init()")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250918114259.1802337-2-peter.maydell@linaro.org>
2025-09-23 16:52:49 -07:00
.github/workflows github: fix config mistake preventing repo lockdown commenting 2022-04-26 16:12:26 +01:00
.gitlab/issue_templates .gitlab/issue_templates: Move suggestions into comments 2022-12-15 15:19:24 +01:00
.gitlab-ci.d ci: temporarily remove rust from Ubuntu 2025-09-17 19:00:56 +02:00
accel accel/kvm: Set guest_memfd_offset to non-zero value only when guest_memfd is valid 2025-09-17 19:01:57 +02:00
audio audio: Reset rate control when adding bytes 2025-05-25 15:25:21 +02:00
authz qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
backends sev: Provide sev_features flags from IGVM VMSA to KVM_SEV_INIT2 2025-07-12 15:28:21 +02:00
block treewide: handle result of qio_channel_set_blocking() 2025-09-19 12:46:07 +01:00
bsd-user * cpu-exec: more cleanups to CPU loop exits 2025-09-18 07:05:59 -07:00
chardev chardev: close an fd on failure path 2025-09-19 12:46:07 +01:00
common-user plugins: fix inclusion of user-mode APIs 2025-07-14 11:42:49 +01:00
configs hw/mips: Remove mipssim machine 2025-09-02 17:57:05 +02:00
contrib util: drop qemu_socket_set_nonblock() 2025-09-19 12:46:07 +01:00
crypto crypto/hmac: Allow to build hmac over multiple qcrypto_gnutls_hmac_bytes[v] calls 2025-09-02 17:58:05 +02:00
disas include/system: Move exec/memory.h to system/memory.h 2025-04-23 14:08:21 -07:00
docs * cpu-exec: more cleanups to CPU loop exits 2025-09-18 07:05:59 -07:00
dump cleanup: Drop pointless return at end of function 2025-04-24 09:33:42 +02:00
ebpf ebpf: improve trace event coverage to all key operations 2024-10-28 14:37:25 +08:00
fpu fpu: Process float_muladd_negate_result after rounding 2025-07-10 11:53:10 -06:00
fsdev 9pfs: Add FreeBSD support 2025-09-18 21:21:29 +02:00
gdb-xml gdbstub: add the GDB register XML files for sparc64. 2025-07-14 11:42:49 +01:00
gdbstub target/arm: Increase MAX_PACKET_LENGTH for SME ZA remote gdb debugging 2025-09-16 17:31:54 +01:00
host/include cpuinfo/i386: Detect GFNI as an AVX extension 2025-09-04 09:49:23 +02:00
hw hw/pci-host/dino: Don't call pci_register_root_bus() in init 2025-09-23 16:52:49 -07:00
include 9pfs changes: 2025-09-19 12:21:35 -07:00
io treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking 2025-09-19 12:46:07 +01:00
libdecnumber libdecnumber: replace FSF postal address with licenses URL 2025-06-26 00:42:37 +02:00
linux-headers linux-headers: Remove the 32-bit arm headers 2025-07-21 07:58:57 +02:00
linux-user linux-user: Add syscall dispatch support 2025-09-23 16:17:59 -07:00
migration migration: qemu_file_set_blocking(): add errp parameter 2025-09-19 12:46:07 +01:00
monitor monitor/hmp-cmds-target: add CPU_DUMP_VPU in hmp_info_registers() 2025-07-04 12:17:52 +02:00
nbd treewide: handle result of qio_channel_set_blocking() 2025-09-19 12:46:07 +01:00
net treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking 2025-09-19 12:46:07 +01:00
pc-bios multiboot: Fix the split lock 2025-09-17 19:00:58 +02:00
plugins plugins: Add memory hardware address read/write API 2025-07-02 10:09:48 +01:00
po po: update Italian translation 2024-08-13 19:01:42 +02:00
python configure: bump Meson to 1.9.0 for use with Rust 2025-09-17 19:00:56 +02:00
qapi rbd: Fix .bdrv_get_specific_info implementation 2025-08-12 14:59:39 +02:00
qga treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking 2025-09-19 12:46:07 +01:00
qobject qapi: Move include/qapi/qmp/ to include/qobject/ 2025-02-10 15:33:16 +01:00
qom qom: qom-list-get 2025-07-16 16:51:21 +02:00
replay cpus: properly kick CPUs out of inner execution loop 2025-09-17 19:00:55 +02:00
roms roms/Makefile: build ast27x0_bootrom 2025-08-03 19:03:21 +02:00
rust rust: do not inline do_init_io 2025-09-17 19:00:58 +02:00
scripts target-arm queue: 2025-09-17 11:10:55 -07:00
scsi treewide: handle result of qio_channel_set_blocking() 2025-09-19 12:46:07 +01:00
semihosting semihosting: Initialize heap once per process 2025-08-28 06:39:25 +10:00
stats qapi: Move include/qapi/qmp/ to include/qobject/ 2025-02-10 15:33:16 +01:00
storage-daemon docs/sphinx: remove special parsing for freeform sections 2025-07-14 10:08:27 +02:00
stubs qapi: make s390x specific CPU commands unconditionally available 2025-05-28 18:56:08 +02:00
subprojects subprojects: update proc-macro2 and syn 2025-08-27 10:57:04 +02:00
system * cpu-exec: more cleanups to CPU loop exits 2025-09-18 07:05:59 -07:00
target target/sparc: Relax decode of rs2_or_imm for v7 2025-09-23 16:51:36 -07:00
tcg tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts 2025-09-04 09:49:30 +02:00
tests treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking 2025-09-19 12:46:07 +01:00
tools treewide: handle result of qio_channel_set_blocking() 2025-09-19 12:46:07 +01:00
trace meson: fix Windows build 2025-06-16 13:16:27 -04:00
ui treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking 2025-09-19 12:46:07 +01:00
util util/vhost-user-server: vu_message_read(): improve error handling 2025-09-19 12:46:07 +01:00
.b4-config b4: Drop linktrailermask 2025-07-03 13:42:28 +02:00
.dir-locals.el
.editorconfig scripts/kernel-doc: Delete the old Perl kernel-doc script 2025-08-30 16:37:23 +01:00
.exrc
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.git-blame-ignore-revs metadata: add .git-blame-ignore-revs 2023-04-04 15:56:44 +01:00
.gitattributes rust: patch bilge-impl to allow compilation with 1.63.0 2024-11-05 14:18:16 +01:00
.gitignore configure: rename --enable-pypi to --enable-download, control subprojects too 2023-06-06 16:30:01 +02:00
.gitlab-ci.yml docs: Document GitLab custom CI/CD variables 2021-07-29 07:56:01 +02:00
.gitmodules .gitmodules: move u-boot mirrors to qemu-project-mirrors 2025-09-16 09:58:20 -07:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: Update Akihiko Odaki's affiliation 2025-06-11 13:08:31 +02:00
.patchew.yml scripts/checkpatch: roll diff tweaking into checkpatch itself 2021-06-25 10:08:33 +01:00
.readthedocs.yml readthedocs: don't build extra formats 2025-08-12 14:59:50 -04:00
.travis.yml travis.yml: Remove the aarch64 job 2025-06-11 12:17:17 +02:00
block.c block: mark bdrv_open_child_common() and its callers GRAPH_UNLOCKED 2025-07-14 15:42:27 +02:00
blockdev-nbd.c qapi: merge common parts of NbdServerOptions and nbd-server-start data 2025-03-04 16:44:48 -06:00
blockdev.c block: mark bdrv_inactivate() as GRAPH_RDLOCK and move drain to callers 2025-07-14 15:42:07 +02:00
blockjob.c block: add bdrv_graph_wrlock_drained() convenience wrapper 2025-07-14 15:40:58 +02:00
clippy.toml meson, cargo: require Rust 1.83.0 2025-09-17 19:00:56 +02:00
configure * cpu-exec: more cleanups to CPU loop exits 2025-09-18 07:05:59 -07:00
COPYING COPYING: replace FSF postal address with licenses URL 2025-06-26 00:42:37 +02:00
COPYING.LIB COPYING: replace FSF postal address with licenses URL 2025-06-26 00:42:37 +02:00
cpu-common.c treewide: rename qemu_wait_io_event/qemu_wait_io_event_common 2025-09-17 19:00:55 +02:00
cpu-target.c cpu-target: build compilation unit once for user/system 2025-09-02 17:57:05 +02:00
event-loop-base.c qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
gitdm.config contrib/gitdm: add group map for AMD 2023-03-22 15:08:26 +00:00
hmp-commands-info.hx accel/system: Add 'info accel' on human monitor 2025-07-15 19:34:33 +02:00
hmp-commands.hx net: Add passt network backend 2025-07-14 13:27:09 +08:00
iothread.c qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
job-qmp.c qapi job: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
job.c test-bdrv-drain: Fix data races 2025-04-08 15:00:01 +02:00
Kconfig build-sys: Add rust feature option 2024-10-07 16:41:58 +02:00
Kconfig.host pvg: do not enable it on cross-architecture targets 2025-02-25 16:18:11 +01:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS MAINTAINERS: list qemu-security@nongnu.org as security contact 2025-09-19 12:46:06 +01:00
Makefile Makefile: prune quilt source files for cscope 2025-07-03 13:42:28 +02:00
meson.build 9pfs: Add FreeBSD support 2025-09-18 21:21:29 +02:00
meson_options.txt meson: remove 'gnutls-bug1717-workaround' for migration TLS crashes 2025-08-05 16:27:25 -03:00
module-common.c
os-posix.c os: add an ability to lock memory on_fault 2025-02-12 11:36:01 -05:00
os-wasm.c include/qemu/osdep.h: Add Emscripten-specific OS dependencies 2025-05-06 16:02:04 +02:00
os-win32.c include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
page-vary-common.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-vary-target.c page-vary: Restrict scope of TARGET_PAGE_BITS_MIN 2025-04-23 15:04:57 -07:00
pythondeps.toml configure: bump Meson to 1.9.0 for use with Rust 2025-09-17 19:00:56 +02:00
qemu-bridge-helper.c qemu-bridge-helper: relocate path to default ACL 2020-09-30 19:11:36 +02:00
qemu-edid.c qemu-edid: Restrict input parameter -d to avoid division by zero 2022-10-12 13:38:15 +02:00
qemu-img-cmds.hx qemu-img: snapshot: allow specifying -f fmt 2025-07-15 20:49:01 +02:00
qemu-img.c qemu-img: extend cvtnum() and use it in more places 2025-07-15 20:49:01 +02:00
qemu-io-cmds.c qapi: Move include/qapi/qmp/ to include/qobject/ 2025-02-10 15:33:16 +01:00
qemu-io.c qapi: Move include/qapi/qmp/ to include/qobject/ 2025-02-10 15:33:16 +01:00
qemu-keymap.c cleanup: Drop pointless return at end of function 2025-04-24 09:33:42 +02:00
qemu-nbd.c nbd: Defer trace init until after daemonization 2025-03-05 13:00:22 -06:00
qemu-options.hx qemu-options.hx: Document the arm-smmuv3 device 2025-09-16 17:31:54 +01:00
qemu.nsi pc-bios: Move device tree files in their own subdir 2025-04-25 17:09:58 +02:00
qemu.sasl sasl: remove comment about obsolete kerberos versions 2021-06-14 13:28:50 +01:00
README.rst README.rst: add the missing punctuations 2024-07-17 14:04:15 +03:00
replication.c replication: move include out of root directory 2021-05-26 14:49:46 +02:00
target-info-stub.c cpu-target: build compilation unit once for user/system 2025-09-02 17:57:05 +02:00
target-info.c qemu: Convert target_words_bigendian() to TargetInfo API 2025-07-15 02:56:39 -04:00
trace-events system/dma-helpers.c: Move trace events to system/trace-events 2024-11-19 14:14:13 +00:00
VERSION Open 10.2 development tree 2025-08-26 14:10:25 -04:00
version.rc configure: remove CONFIG_FILEVERSION and CONFIG_PRODUCTVERSION 2021-01-02 21:03:37 +01:00

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Documentation
=============

Documentation can be found hosted online at
`<https://www.qemu.org/documentation/>`_. The documentation for the
current development version that is available at
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
folder in the source tree, and is built by `Sphinx
<https://www.sphinx-doc.org/en/master/>`_.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://wiki.qemu.org/Hosts/Linux>`_
* `<https://wiki.qemu.org/Hosts/Mac>`_
* `<https://wiki.qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://gitlab.com/qemu-project/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the `style section
<https://www.qemu.org/docs/master/devel/style.html>`_ of
the Developers Guide.

Additional information on submitting patches can be found online via
the QEMU website:

* `<https://wiki.qemu.org/Contribute/SubmitAPatch>`_
* `<https://wiki.qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://gitlab.com/qemu-project/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to:

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses GitLab issues to track bugs. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://gitlab.com/qemu-project/qemu/-/issues>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via GitLab.

For additional information on bug reporting consult:

* `<https://wiki.qemu.org/Contribute/ReportABug>`_


ChangeLog
=========

For version history and release notes, please visit
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
more detailed information.


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC:

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://wiki.qemu.org/Contribute/StartHere>`_