diff options
| author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2019-06-13 23:34:06 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2019-07-02 09:43:58 +1000 |
| commit | 740a19313b85527f6984b0fd4fee9b683b4ea1e2 (patch) | |
| tree | 5a153ce899eb48a9120aa0abb9db65fad6eedcd9 /hw/ppc/spapr_pci.c | |
| parent | c29a0b0fb3520a2ab5fe566bf39340b4ef3efeb9 (diff) | |
| download | focaccia-qemu-740a19313b85527f6984b0fd4fee9b683b4ea1e2.tar.gz focaccia-qemu-740a19313b85527f6984b0fd4fee9b683b4ea1e2.zip | |
spapr_pci: Fix potential NULL pointer dereference in spapr_dt_pci_bus()
Commit 14e714900f6 refactored the call to spapr_dt_drc(), introducing a potential NULL pointer dereference while accessing bus->parent_dev. A trivial audit show 'bus' is not null in the two places the static function spapr_dt_drc() is called. Since the 'bus' parameter is not NULL in both callers, remove remove the test on if (bus), and add an assert() to silent static analyzers. This fixes: /hw/ppc/spapr_pci.c: 1367 in spapr_dt_pci_bus() >>> CID 1401933: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "bus". 1367 ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), 1368 SPAPR_DR_CONNECTOR_TYPE_PCI); Fixes: 14e714900f6 Reported-by: Coverity (CID 1401933) Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190613213406.22053-1-philmd@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw/ppc/spapr_pci.c')
| -rw-r--r-- | hw/ppc/spapr_pci.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c index 957ae88bbd..fbeb1c90ee 100644 --- a/hw/ppc/spapr_pci.c +++ b/hw/ppc/spapr_pci.c @@ -1356,12 +1356,11 @@ static int spapr_dt_pci_bus(SpaprPhbState *sphb, PCIBus *bus, _FDT(fdt_setprop_cell(fdt, offset, "#size-cells", RESOURCE_CELLS_SIZE)); - if (bus) { - pci_for_each_device_reverse(bus, pci_bus_num(bus), - spapr_dt_pci_device_cb, &cbinfo); - if (cbinfo.err) { - return cbinfo.err; - } + assert(bus); + pci_for_each_device_reverse(bus, pci_bus_num(bus), + spapr_dt_pci_device_cb, &cbinfo); + if (cbinfo.err) { + return cbinfo.err; } ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), |