From: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Mon, 27 Apr 2026 12:26:25 +0000 (+0400)
Subject: hw/ppc/spapr: free host_model and host_serial on finalization
X-Git-Tag: v11.1.0-rc0~75^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8a2b57ad2ae2ab4fb3a7124f60ec74a51f41a5cc;p=thirdparty%2Fqemu.git

hw/ppc/spapr: free host_model and host_serial on finalization

The host_model and host_serial strings are allocated via g_strdup in
property setters but never freed when the machine is destroyed.

Fixes: 27461d69a0f ("ppc: add host-serial and host-model machine attributes (CVE-2019-8934)")
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 191f7431bd..f0e99bb5be 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3517,6 +3517,8 @@ static void spapr_machine_finalizefn(Object *obj)
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 
     g_free(spapr->kvm_type);
+    g_free(spapr->host_model);
+    g_free(spapr->host_serial);
 }
 
 void spapr_do_system_reset_on_cpu(CPUState *cs, run_on_cpu_data arg)