motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-03 07:43:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

virtio-gpu: Fix memory leak in virtio_gpu_load()

Browse source 
Coverity points out that if we fail in the "creating resources"
loop in virtio_gpu_load() we will leak various resources (CID 1356431).
Failing a VM load is going to leave the simulation in a complete mess,
but we can tidy up to the point that a full system reset should
get us back to sanity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1483969123-14839-3-git-send-email-peter.maydell@linaro.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Peter Maydell 2017-01-09 13:38:43 +00:00 • committed by Gerd Hoffmann
parent 039aa5db0e
commit c84f0f25db
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hw/display/virtio-gpu.c
View file

@ -1052,12 +1052,14 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size)
/* allocate */ /* allocate */
pformat = get_pixman_format(res->format); pformat = get_pixman_format(res->format);
if (!pformat) { if (!pformat) {
g_free(res);
return -EINVAL; return -EINVAL;
} }
res->image = pixman_image_create_bits(pformat, res->image = pixman_image_create_bits(pformat,
res->width, res->height, res->width, res->height,
NULL, 0); NULL, 0);
if (!res->image) { if (!res->image) {
g_free(res);
return -EINVAL; return -EINVAL;
} }
@ -1080,6 +1082,16 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size)
res->iov[i].iov_base = res->iov[i].iov_base =
cpu_physical_memory_map(res->addrs[i], &len, 1); cpu_physical_memory_map(res->addrs[i], &len, 1);
if (!res->iov[i].iov_base || len != res->iov[i].iov_len) { if (!res->iov[i].iov_base || len != res->iov[i].iov_len) {
/* Clean up the half-a-mapping we just created... */
if (res->iov[i].iov_base) {
cpu_physical_memory_unmap(res->iov[i].iov_base,
len, 0, 0);
}
/* ...and the mappings for previous loop iterations */
res->iov_cnt = i;
virtio_gpu_cleanup_mapping(res);
pixman_image_unref(res->image);
g_free(res);
return -EINVAL; return -EINVAL;
} }
} }