*spapr_rtas: fix potential use-after-free

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
mdroth · Mar 4, 2015 · 3fd03f6 · 3fd03f6
1 parent 607f43a
commit 3fd03f6
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
@@ -517,6 +517,8 @@ static void rtas_ibm_configure_connector(PowerPCCPU *cpu,
             ccs->fdt_depth--;
             if (ccs->fdt_depth == 0) {
                 drck->complete_configure_connector(drc);
+                /* ccs should be free at this point */
+                ccs = NULL;
                 resp = SPAPR_DR_CC_RESPONSE_SUCCESS;
             } else {
                 resp = SPAPR_DR_CC_RESPONSE_PREV_PARENT;
@@ -551,7 +553,9 @@ static void rtas_ibm_configure_connector(PowerPCCPU *cpu,
             /* keep seeking for an actionable tag */
             break;
         }
-        ccs->fdt_offset = fdt_offset_next;
+        if (ccs) {
+            ccs->fdt_offset = fdt_offset_next;
+        }
     } while (resp == SPAPR_DR_CC_RESPONSE_CONTINUE);
 
     rc = resp;