qemu/target/i386
Eduardo Habkost e38bf61247 i386: Fix arch_query_cpu_model_expansion() leak
Reported by Coverity:

Error: RESOURCE_LEAK (CWE-772): [#def439]
qemu-2.12.0/target/i386/cpu.c:3179: alloc_fn: Storage is returned from allocation function "qdict_new".
qemu-2.12.0/qobject/qdict.c:34:5: alloc_fn: Storage is returned from allocation function "g_malloc0".
qemu-2.12.0/qobject/qdict.c:34:5: var_assign: Assigning: "qdict" = "g_malloc0(4120UL)".
qemu-2.12.0/qobject/qdict.c:37:5: return_alloc: Returning allocated memory "qdict".
qemu-2.12.0/target/i386/cpu.c:3179: var_assign: Assigning: "props" = storage returned from "qdict_new()".
qemu-2.12.0/target/i386/cpu.c:3217: leaked_storage: Variable "props" going out of scope leaks the storage it points to.

This was introduced by commit b8097deb35 ("i386: Improve
query-cpu-model-expansion full mode").

The leak is only theoretical: if ret->model->props is set to
props, the qapi_free_CpuModelExpansionInfo() call will free props
too in case of errors.  The only way for this to not happen is if
we enter the default branch of the switch statement, which would
never happen because all CpuModelExpansionType values are being
handled.

It's still worth to change this to make the allocation logic
easier to follow and make the Coverity error go away.  To make
everything simpler, initialize ret->model and ret->model->props
earlier in the function.

While at it, remove redundant check for !prop because prop is
always initialized at the beginning of the function.

Fixes: b8097deb35
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20180816183509.8231-1-ehabkost@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23 18:46:25 +02:00
..
hvf target: Do not include "exec/exec-all.h" if it is not necessary 2018-06-01 14:15:10 +02:00
arch_dump.c dump: add kernel_gs_base to QEMU CPU state 2018-07-16 16:13:34 +02:00
arch_memory_mapping.c exec,dump,i386,ppc,s390x: don't include exec/cpu-all.h explicitly 2017-09-19 18:21:33 +02:00
bpt_helper.c target-i386: Fix eflags.TF/#DB handling of syscall/sysret insns 2016-12-22 16:01:04 +01:00
cc_helper.c target-i386: Use ctpop helper 2017-01-10 08:49:59 -08:00
cc_helper_template.h
cpu-qom.h i386: refactor KVM cpuid code so that it applies to hvf as well 2017-12-22 15:01:48 +01:00
cpu.c i386: Fix arch_query_cpu_model_expansion() leak 2018-08-23 18:46:25 +02:00
cpu.h i386: Add CPUID bit for WBNOINVD 2018-08-16 13:43:01 -03:00
excp_helper.c target-i386: Add NPT support 2018-07-02 15:41:18 +02:00
fpu_helper.c target/*/cpu.h: remove softfloat.h 2018-02-21 10:20:24 +00:00
gdbstub.c x86: Fix x86_64 'g' packet response to gdb from 32-bit mode. 2016-12-22 16:00:25 +01:00
hax-all.c target: Do not include "exec/exec-all.h" if it is not necessary 2018-06-01 14:15:10 +02:00
hax-darwin.c Remove unnecessary variables for function return value 2018-05-20 08:48:13 +03:00
hax-darwin.h hax: Support guest RAM sizes of 4GB or more 2018-02-13 11:44:13 +01:00
hax-i386.h hax: Support guest RAM sizes of 4GB or more 2018-02-13 11:44:13 +01:00
hax-interface.h hax: Support guest RAM sizes of 4GB or more 2018-02-13 11:44:13 +01:00
hax-mem.c target: Do not include "exec/exec-all.h" if it is not necessary 2018-06-01 14:15:10 +02:00
hax-windows.c target: Do not include "exec/exec-all.h" if it is not necessary 2018-06-01 14:15:10 +02:00
hax-windows.h hax: Support guest RAM sizes of 4GB or more 2018-02-13 11:44:13 +01:00
helper.c icount: fix cpu_restore_state_from_tb for non-tb-exit cases 2018-04-11 09:05:22 +10:00
helper.h target-i386: correctly propagate retaddr into SVM helpers 2017-02-16 18:37:01 +01:00
hyperv-proto.h i386/kvm: add support for Hyper-V TLB flush 2018-07-02 14:45:23 +02:00
hyperv.c hyperv: ensure VP index equal to QEMU cpu_index 2018-07-16 16:58:16 +02:00
hyperv.h hyperv: ensure VP index equal to QEMU cpu_index 2018-07-16 16:58:16 +02:00
int_helper.c target-i386: Use clz and ctz opcodes 2017-01-10 08:06:11 -08:00
kvm-stub.c hyperv: ensure VP index equal to QEMU cpu_index 2018-07-16 16:58:16 +02:00
kvm.c hyperv: ensure VP index equal to QEMU cpu_index 2018-07-16 16:58:16 +02:00
kvm_i386.h hyperv: ensure VP index equal to QEMU cpu_index 2018-07-16 16:58:16 +02:00
machine.c i386: do not migrate MSR_SMI_COUNT on machine types <2.12 2018-07-30 14:00:11 +02:00
Makefile.objs sev/i386: add command to initialize the memory encryption context 2018-03-13 17:35:16 +01:00
mem_helper.c target-i386: Add NPT support 2018-07-02 15:41:18 +02:00
misc_helper.c i386: implement MSR_SMI_COUNT for TCG 2018-07-30 14:00:11 +02:00
monitor.c i386/monitor.c: make addresses canonical for "info mem" and "info tlb" 2018-07-02 15:41:18 +02:00
mpx_helper.c target/i386: move cpu_sync_bndcs_hflags() function 2017-07-05 09:12:44 +02:00
ops_sse.h target/i386: fix phminposuw in-place operation 2017-09-19 14:09:11 +02:00
ops_sse_header.h target-i386: Use ctpop helper 2017-01-10 08:49:59 -08:00
seg_helper.c target-i386: Add NMI interception to SVM 2018-06-28 19:05:36 +02:00
sev-stub.c sev/i386: add sev_get_capabilities() 2018-03-13 17:36:06 +01:00
sev.c target/i386: sev: fix memory leaks 2018-05-09 00:13:39 +02:00
sev_i386.h sev/i386: add sev_get_capabilities() 2018-03-13 17:36:06 +01:00
shift_helper_template.h
smm_helper.c i386: implement MSR_SMI_COUNT for TCG 2018-07-30 14:00:11 +02:00
svm.h target-i386: Add NPT support 2018-07-02 15:41:18 +02:00
svm_helper.c target-i386: Add NPT support 2018-07-02 15:41:18 +02:00
TODO
trace-events sev/i386: finalize the SEV guest launch flow 2018-03-13 17:36:05 +01:00
translate.c fix "Missing break in switch" coverity reports 2018-08-23 13:32:50 +02:00
whp-dispatch.h whpx: commit missing file 2018-06-28 19:05:31 +02:00
whpx-all.c WHPX: register for unrecognized MSR exits 2018-06-28 19:05:36 +02:00
xsave_helper.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00