On 9/14/23 11:44, Миронов Сергей Владимирович wrote:
> There are no checks, virDomainChrSourceDefNew can return 0.
>
>
> Return value of a function 'virDomainChrSourceDefNew'
>
> is dereferenced at qemu_hotplug.c without checking for NULL,
>
> but it is usually checked for this function.
>
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
>
> Fixes: 1f85f0967b ("ci: jobs.sh: Add back '--no-suite syntax-check
> --print-errorlogs'")
>
> Signed-off-by: Sergey Mironov <[email protected]>
>
> ---
> src/qemu/qemu_hotplug.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
> index 177ca87d11..09e16c2c7e 100644
> --- a/src/qemu/qemu_hotplug.c
> +++ b/src/qemu/qemu_hotplug.c
> @@ -3207,6 +3207,8 @@ qemuDomainAttachFSDevice(virQEMUDriver *driver,
> qemuAssignDeviceFSAlias(vm->def, fs);
>
> chardev = virDomainChrSourceDefNew(priv->driver->xmlopt);
> + if (chardev == NULL)
> + goto cleanup;
> chardev->type = VIR_DOMAIN_CHR_TYPE_UNIX;
> chardev->data.nix.path = qemuDomainGetVHostUserFSSocketPath(priv, fs);
Apart from Peter's findings, there are more cases like this:
qemuBuildVideoCommandLine(), qemuVirtioFSOpenChardev(),
qemuMonitorJSONTestAttachChardev().
Might be worth fixing them too.
Michal
