Re: PATCH] hw/s390x/s390-hypercall: fix potential NULL dereference in handle_virtio_ccw_notify

["Michael S. Tsirkin" <mst@redhat.com>]

On Tue, Sep 15, 2026 at 07:17:28PM +0300, Николай Зорин wrote:
> SWSA#4992cdf0-415c-45c1-be1a-71213467347d
> 
> The `virtio_ccw_get_vdev()` function can return a `NULL` pointer if the
> corresponding subchannel driver data (`sch->driver_data`) is not initialized
> or has been cleared.

and when does this happen?

> If `vdev` is `NULL`, passing it directly into `virtio_queue_get_num(vdev,
> vq_idx)`
> results in a `NULL` pointer dereference, which can lead to a hypervisor
> crash or unexpected termination of the QEMU process.
> 
> Fix this by adding an explicit check for `!vdev` before verifying the
> queue index and its capacity, returning `-EINVAL` early if the device
> is missing or not bound to the subchannel.


Please do not use this style with `` - there's no reason to. Just
say NULL -EINVAL etc normally.

> 
> Signed-off-by: Nikolay N Zorin <zorin@swemel.ru>
> ---
>  hw/s390x/s390-hypercall.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/s390x/s390-hypercall.c b/hw/s390x/s390-hypercall.c
> index ac1b08b2..fd2972c0 100644
> --- a/hw/s390x/s390-hypercall.c
> +++ b/hw/s390x/s390-hypercall.c
> @@ -44,7 +44,7 @@ static int handle_virtio_ccw_notify(uint64_t subch_id,
> uint64_t data)
>      }
> 
>      vdev = virtio_ccw_get_vdev(sch);
> -    if (vq_idx >= VIRTIO_QUEUE_MAX || !virtio_queue_get_num(vdev, vq_idx))
> {
> +    if (!vdev || vq_idx >= VIRTIO_QUEUE_MAX || !virtio_queue_get_num(vdev,
> vq_idx)) {
>          return -EINVAL;
>      }
> -- 
> 2.43.0