From: Philippe Mathieu-Daudé <[email protected]> Commit 14e714900f6 refactored the call to spapr_dt_drc(), introducing a potential NULL pointer dereference while accessing bus->parent_dev. A trivial audit show 'bus' is not null in the two places the static function spapr_dt_drc() is called.
Since the 'bus' parameter is not NULL in both callers, remove remove the test on if (bus), and add an assert() to silent static analyzers. This fixes: /hw/ppc/spapr_pci.c: 1367 in spapr_dt_pci_bus() >>> CID 1401933: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "bus". 1367 ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), 1368 SPAPR_DR_CONNECTOR_TYPE_PCI); Fixes: 14e714900f6 Reported-by: Coverity (CID 1401933) Suggested-by: Greg Kurz <[email protected]> Suggested-by: David Gibson <[email protected]> Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Message-Id: <[email protected]> Signed-off-by: David Gibson <[email protected]> --- hw/ppc/spapr_pci.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c index 957ae88bbd..fbeb1c90ee 100644 --- a/hw/ppc/spapr_pci.c +++ b/hw/ppc/spapr_pci.c @@ -1356,12 +1356,11 @@ static int spapr_dt_pci_bus(SpaprPhbState *sphb, PCIBus *bus, _FDT(fdt_setprop_cell(fdt, offset, "#size-cells", RESOURCE_CELLS_SIZE)); - if (bus) { - pci_for_each_device_reverse(bus, pci_bus_num(bus), - spapr_dt_pci_device_cb, &cbinfo); - if (cbinfo.err) { - return cbinfo.err; - } + assert(bus); + pci_for_each_device_reverse(bus, pci_bus_num(bus), + spapr_dt_pci_device_cb, &cbinfo); + if (cbinfo.err) { + return cbinfo.err; } ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), -- 2.21.0
