On 9/14/23 11:44, Миронов Сергей Владимирович wrote:
There are no checks, virDomainChrSourceDefNew can return 0.
Return value of a function 'virDomainChrSourceDefNew'
is dereferenced at qemu_hotplug.c without checking for NULL,
but it is usually checked for this function.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1f85f0967b ("ci: jobs.sh: Add back '--no-suite syntax-check --print-errorlogs'")
Signed-off-by: Sergey Mironov <mironov@fintech.ru>
--- src/qemu/qemu_hotplug.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 177ca87d11..09e16c2c7e 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3207,6 +3207,8 @@ qemuDomainAttachFSDevice(virQEMUDriver *driver, qemuAssignDeviceFSAlias(vm->def, fs);
chardev = virDomainChrSourceDefNew(priv->driver->xmlopt); + if (chardev == NULL) + goto cleanup; chardev->type = VIR_DOMAIN_CHR_TYPE_UNIX; chardev->data.nix.path = qemuDomainGetVHostUserFSSocketPath(priv, fs);
Apart from Peter's findings, there are more cases like this: qemuBuildVideoCommandLine(), qemuVirtioFSOpenChardev(), qemuMonitorJSONTestAttachChardev(). Might be worth fixing them too. Michal