On Mon, Oct 05, 2026 at 02:33:00 +0300, Elizaveta Tereshkina wrote:
qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value to model_info if QEMU returns a GenericError. Passing NULL to qemuConnectStealCPUModelFromInfo() can lead to the NULL pointer dereference. Check the result before stealing the CPU model to avoid this.
Fixes: aa797c6625 (qemu_driver: expand cpu features after baseline) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea@gmail.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ebf19d7c0f..5922065897 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -12382,7 +12382,7 @@ qemuConnectCPUModelBaseline(virQEMUCaps *qemuCaps, false, false, &result) < 0) return NULL;
- if (qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) + if (result && qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) return NULL; }
I was thinking about handling the situation in a better way, such as by reporting an error. But I think this is OK, at this point we already successfully called query-cpu-model-baseline so query-cpu-model-expansion should be implemented as well. They either both exist or none of them. Reviewed-by: Jiri Denemark <jdenemar@redhat.com> and pushed, thanks.