From eda9baa17a2854494709a8094419ba6a6901721d Mon Sep 17 00:00:00 2001 From: Akihiko Odaki Date: Sun, 25 Jan 2026 15:42:47 +0900 Subject: [PATCH] hw/nvme: Fix bootindex suffix use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bootindex suffix can be used as long as the property is alive. Signed-off-by: Akihiko Odaki Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260125-nvme-v1-5-0658c31fade9@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Philippe Mathieu-Daudé --- hw/nvme/ns.c | 7 +++---- hw/nvme/nvme.h | 1 + 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c index 58800b3414..38f86a1726 100644 --- a/hw/nvme/ns.c +++ b/hw/nvme/ns.c @@ -944,12 +944,11 @@ static void nvme_ns_class_init(ObjectClass *oc, const void *data) static void nvme_ns_instance_init(Object *obj) { NvmeNamespace *ns = NVME_NS(obj); - char *bootindex = g_strdup_printf("/namespace@%d,0", ns->params.nsid); - device_add_bootindex_property(obj, &ns->bootindex, "bootindex", - bootindex, DEVICE(obj)); + sprintf(ns->bootindex_suffix, "/namespace@%" PRIu32 ",0", ns->params.nsid); - g_free(bootindex); + device_add_bootindex_property(obj, &ns->bootindex, "bootindex", + ns->bootindex_suffix, DEVICE(obj)); } static const TypeInfo nvme_ns_info = { diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h index 8f8c78c850..d66f7dc82d 100644 --- a/hw/nvme/nvme.h +++ b/hw/nvme/nvme.h @@ -239,6 +239,7 @@ typedef struct NvmeNamespace { DeviceState parent_obj; BlockConf blkconf; int32_t bootindex; + char bootindex_suffix[24]; int64_t size; int64_t moff; NvmeIdNs id_ns;