[PATCH] util/vhost-user-server: fix potential NULL dereference in vu_message_read

[PATCH] util/vhost-user-server: fix potential NULL dereference in vu_message_read

[Николай Зорин]

The `vu_message_read()` function initializes `local_err` to `NULL`.
If `server->ioc` is `NULL`, the execution jumps to the `if (!ioc)`
branch and invokes `error_report_err(local_err)`.

Passing a guaranteed `NULL` pointer to `error_report_err()` leads
to a crash because `error_get_pretty(err)` will attempt to dereference
`err->msg`, triggering a Segmentation Fault (`SIGSEGV`).

Since `server->ioc` shouldn't be `NULL` during an active coroutine
execution, this error block is effectively dead code, but it represents
a dangerous pattern left over from copy-pasting or incomplete refactoring.

Fix this by removing the incorrect `error_report_err(local_err)` call
inside the `if (!ioc)` block. The `local_err` variable itself is preserved
as it is used later in the function for actual I/O error handling.

Signed-off-by: Nikolay N Zorin <zorin@swemel.ru>
---
  util/vhost-user-server.c | 1 -
  1 file changed, 1 deletion(-)

diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index f30f6b3e..a4b2c1d0 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -15,7 +15,6 @@ static bool coroutine_fn vu_message_read(VuDev 
*vu_dev, int conn_fd, VhostUserMs

      vmsg->fd_num = 0;
      if (!ioc) {
-        error_report_err(local_err);
          goto fail;
      }

-- 
2.43.0

Re: [PATCH] util/vhost-user-server: fix potential NULL dereference in vu_message_read

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1756 bytes --]

On Tue, Sep 15, 2026 at 04:02:31PM +0300, Николай Зорин wrote:
> The `vu_message_read()` function initializes `local_err` to `NULL`.
> If `server->ioc` is `NULL`, the execution jumps to the `if (!ioc)`
> branch and invokes `error_report_err(local_err)`.
> 
> Passing a guaranteed `NULL` pointer to `error_report_err()` leads
> to a crash because `error_get_pretty(err)` will attempt to dereference
> `err->msg`, triggering a Segmentation Fault (`SIGSEGV`).
> 
> Since `server->ioc` shouldn't be `NULL` during an active coroutine
> execution, this error block is effectively dead code, but it represents
> a dangerous pattern left over from copy-pasting or incomplete refactoring.
> 
> Fix this by removing the incorrect `error_report_err(local_err)` call
> inside the `if (!ioc)` block. The `local_err` variable itself is preserved
> as it is used later in the function for actual I/O error handling.
> 
> Signed-off-by: Nikolay N Zorin <zorin@swemel.ru>
> ---
>  util/vhost-user-server.c | 1 -
>  1 file changed, 1 deletion(-)

This was fixed by commit 34523df31962 ("util/vhost-user-server:
vu_message_read(): improve error handling") and is no longer present in
qemu.git/master.

Please check against qemu.git/master to avoid duplicating work.

Thanks,
Stefan

> 
> diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
> index f30f6b3e..a4b2c1d0 100644
> --- a/util/vhost-user-server.c
> +++ b/util/vhost-user-server.c
> @@ -15,7 +15,6 @@ static bool coroutine_fn vu_message_read(VuDev *vu_dev,
> int conn_fd, VhostUserMs
> 
>      vmsg->fd_num = 0;
>      if (!ioc) {
> -        error_report_err(local_err);
>          goto fail;
>      }
> 
> -- 
> 2.43.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]