From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:47974)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1XTnjP-000268-EZ
	for qemu-devel@nongnu.org; Tue, 16 Sep 2014 04:03:29 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1XTnjJ-00059Q-QI
	for qemu-devel@nongnu.org; Tue, 16 Sep 2014 04:03:23 -0400
Received: from mx1.redhat.com ([209.132.183.28]:54854)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1XTnjJ-00058Z-Ha
	for qemu-devel@nongnu.org; Tue, 16 Sep 2014 04:03:17 -0400
From: Markus Armbruster <armbru@redhat.com>
References: <1410833973-9492-1-git-send-email-arei.gonglei@huawei.com>
Date: Tue, 16 Sep 2014 09:28:26 +0200
In-Reply-To: <1410833973-9492-1-git-send-email-arei.gonglei@huawei.com> (arei
	gonglei's message of "Tue, 16 Sep 2014 10:19:33 +0800")
Message-ID: <87oaugxbvp.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain
Subject: Re: [Qemu-devel] [PATCH] qdev-monitor: fix segmentation fault on
	qdev_device_help()
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: arei.gonglei@huawei.com
Cc: weidong.huang@huawei.com, qemu-devel@nongnu.org, lcapitulino@redhat.com, stefanha@redhat.com, imammedo@redhat.com, peter.huangpeng@huawei.com, afaerber@suse.de

<arei.gonglei@huawei.com> writes:

> From: Gonglei <arei.gonglei@huawei.com>
>
> Normally, qmp_device_list_properties() may return NULL when
> a device haven't special properties excpet Object and DeviceState
> properties, such as virtio-balloon-device.
>
> We just need check local_err instead of prop_list.
>
> Example:
>
> Segmentation fault (core dumped)
>
> The backtrace as below:
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x00005555559af1a8 in error_get_pretty (err=0x0) at util/error.c:152
> 152         return err->msg;
> (gdb) bt
> #0  0x00005555559af1a8 in error_get_pretty (err=0x0) at util/error.c:152
> #1  0x000055555572fce9 in qdev_device_help (opts=0x5555562fdfe0) at qdev-monitor.c:210
> #2  0x000055555574a6f2 in device_help_func (opts=0x5555562fdfe0, opaque=0x0) at vl.c:2362
> #3  0x00005555559c0a33 in qemu_opts_foreach (list=0x555555dd0b40 <qemu_device_opts>, 
>     func=0x55555574a6ca <device_help_func>, opaque=0x0, abort_on_failure=0) at util/qemu-option.c:1072
> #4  0x000055555574f514 in main (argc=3, argv=0x7fffffffe218, envp=0x7fffffffe238) at vl.c:4246
>
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
>  qdev-monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/qdev-monitor.c b/qdev-monitor.c
> index fb9ee24..5ec6606 100644
> --- a/qdev-monitor.c
> +++ b/qdev-monitor.c
> @@ -206,7 +206,7 @@ int qdev_device_help(QemuOpts *opts)
>      }
>  
>      prop_list = qmp_device_list_properties(driver, &local_err);
> -    if (!prop_list) {
> +    if (local_err) {
>          error_printf("%s\n", error_get_pretty(local_err));
>          error_free(local_err);
>          return 1;

Doesn't this leak prop_list when local_err && prop_list?

Returning both a value in need of destruction and an error object is at
least highly unusual, and probably plain wrong.

Should qmp_device_list_properties() return NULL when it sets an error?