qmp: object-add: Validate class before creating object
Currently it is very easy to crash QEMU by issuing an object-add command
using an abstract class or a class that doesn't support
TYPE_USER_CREATABLE as parameter.
Example: with the following QMP command:
(QEMU) object-add qom-type=cpu id=foo
QEMU aborts at:
ERROR:qom/object.c:335:object_initialize_with_type: assertion failed: (type->abstract == false)
This patch moves the check for TYPE_USER_CREATABLE before object_new(),
and adds a check to prevent the code from trying to instantiate abstract
classes.
Signed-off-by: Eduardo Habkost <[email protected]>
Reviewed-by: Matthew Rosato <[email protected]>
Tested-by: Matthew Rosato <[email protected]>
Signed-off-by: Luiz Capitulino <[email protected]>
diff --git a/qmp.c b/qmp.c
index 5e2a66c..74107be 100644
--- a/qmp.c
+++ b/qmp.c
@@ -540,14 +540,27 @@
Visitor *v, Error **errp)
{
Object *obj;
+ ObjectClass *klass;
const QDictEntry *e;
Error *local_err = NULL;
- if (!object_class_by_name(type)) {
+ klass = object_class_by_name(type);
+ if (!klass) {
error_setg(errp, "invalid class name");
return;
}
+ if (!object_class_dynamic_cast(klass, TYPE_USER_CREATABLE)) {
+ error_setg(errp, "object type '%s' isn't supported by object-add",
+ type);
+ return;
+ }
+
+ if (object_class_is_abstract(klass)) {
+ error_setg(errp, "object type '%s' is abstract", type);
+ return;
+ }
+
obj = object_new(type);
if (qdict) {
for (e = qdict_first(qdict); e; e = qdict_next(qdict, e)) {
@@ -558,12 +571,6 @@
}
}
- if (!object_dynamic_cast(obj, TYPE_USER_CREATABLE)) {
- error_setg(&local_err, "object type '%s' isn't supported by object-add",
- type);
- goto out;
- }
-
user_creatable_complete(obj, &local_err);
if (local_err) {
goto out;
