[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] s390: avoid potential null dereference in s390_
From: |
Cornelia Huck |
Subject: |
Re: [Qemu-devel] [PATCH] s390: avoid potential null dereference in s390_pcihost_unplug() |
Date: |
Thu, 3 Jan 2019 15:54:38 +0100 |
On Thu, 3 Jan 2019 06:02:46 -0800
Li Qiang <address@hidden> wrote:
> When getting the 'pbdev', the if...else has no default branch.
> From Coverity, the 'pbdev' maybe null when the 'dev' is not
> the TYPE_PCI_BRIDGE/TYPE_PCI_DEVICE/TYPE_S390_PCI_DEVICE.
>
> Spotted by Coverity: CID 1398593
>
> Signed-off-by: Li Qiang <address@hidden>
> ---
> hw/s390x/s390-pci-bus.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
> index 15759b6514..b3122268a3 100644
> --- a/hw/s390x/s390-pci-bus.c
> +++ b/hw/s390x/s390-pci-bus.c
> @@ -956,6 +956,10 @@ static void s390_pcihost_unplug(HotplugHandler
> *hotplug_dev, DeviceState *dev,
> } else if (object_dynamic_cast(OBJECT(dev), TYPE_S390_PCI_DEVICE)) {
> pbdev = S390_PCI_DEVICE(dev);
> pci_dev = pbdev->pdev;
> + } else {
> + error_setg(errp, "s390: device unplug for not supported device"
> + " type: %s", object_get_typename(OBJECT(dev)));
> + return;
I think that is something that really Should Not Happen. However,
looking at s390_pcihost_plug, we just do nothing if the plugged device
does not match any of the expected three values. Maybe we should also
set an error in that case there?
> }
>
> switch (pbdev->state) {