From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:57039) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TfeWn-0006G5-VR for qemu-devel@nongnu.org; Mon, 03 Dec 2012 17:30:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TfeWm-0007KT-UM for qemu-devel@nongnu.org; Mon, 03 Dec 2012 17:30:17 -0500 Sender: fluxion From: Michael Roth Date: Mon, 3 Dec 2012 16:25:46 -0600 Message-Id: <1354573559-26274-3-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1354573559-26274-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1354572547-21271-1-git-send-email-mdroth@linux.vnet.ibm.com> <1354573559-26274-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 30/43] hmp: do not crash on invalid SCSI hotplug List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-stable@nongnu.org Cc: aliguori@us.ibm.com, qemu-devel@nongnu.org From: Paolo Bonzini Commit 0d93692 (qdev: Convert busses to QEMU Object Model, 2012-05-02) removed a check on the type of the bus where a SCSI disk is hotplugged. However, hot-plugging to the wrong kind of device now causes a crash due to either a NULL pointer dereference (avoided by the previous patch) or a failed QOM cast. Instead, in this case we need to use object_dynamic_cast and check for the result, similar to what was done before that commit. Reported-by: Markus Armbruster Signed-off-by: Paolo Bonzini Signed-off-by: Anthony Liguori (cherry picked from commit b5007bcc9729acd995518c52eb1038c4d8416b5d) Signed-off-by: Michael Roth --- hw/pci-hotplug.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/pci-hotplug.c b/hw/pci-hotplug.c index e7fb780..0ca5546 100644 --- a/hw/pci-hotplug.c +++ b/hw/pci-hotplug.c @@ -80,7 +80,13 @@ static int scsi_hot_add(Monitor *mon, DeviceState *adapter, SCSIBus *scsibus; SCSIDevice *scsidev; - scsibus = SCSI_BUS(QLIST_FIRST(&adapter->child_bus)); + scsibus = (SCSIBus *) + object_dynamic_cast(OBJECT(QLIST_FIRST(&adapter->child_bus)), + TYPE_SCSI_BUS); + if (!scsibus) { + error_report("Device is not a SCSI adapter"); + return -1; + } /* * drive_init() tries to find a default for dinfo->unit. Doesn't -- 1.7.9.5