[Qemu-devel] [BUG][PATCH] Fix a nullpointer crash caused by r6216

[Qemu-devel] [BUG][PATCH] Fix a nullpointer crash caused by r6216

[Stefan Weil]

[-- Attachment #1: Type: text/plain, Size: 288 bytes --]

Hi,

this patch tries to fix a nullpointer crash caused by r6216 (nd->model
needs value != NULL).
See also http://lists.gnu.org/archive/html/qemu-devel/2009-01/msg00257.html.

mips-r4k.c was already fixed but now contained a copy-paste bug (index i
is wrong here).

Regards
Stefan Weil



[-- Attachment #2: fixmodel.patch --]
[-- Type: text/x-diff, Size: 3839 bytes --]

fix nullpointer crash caused by r6216 (nd->model needs value != NULL)
mips-r4k.c was already fixed but now contained a copy-paste bug

Signed-off-by: Stefan Weil <weil@mail.berlios.de>

Index: trunk/hw/integratorcp.c
===================================================================
--- trunk.orig/hw/integratorcp.c	2009-01-11 19:40:41.000000000 +0100
+++ trunk/hw/integratorcp.c	2009-01-11 19:40:49.000000000 +0100
@@ -498,8 +498,10 @@
     }
     pl181_init(0x1c000000, drives_table[sd].bdrv, pic[23], pic[24]);
     if (nd_table[0].vlan) {
-        if (nd_table[0].model == NULL
-            || strcmp(nd_table[0].model, "smc91c111") == 0) {
+        if (nd_table[0].model == NULL) {
+            nd_table[0].model = "smc91c111";
+        }
+        if (strcmp(nd_table[0].model, "smc91c111") == 0) {
             smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
         } else if (strcmp(nd_table[0].model, "?") == 0) {
             fprintf(stderr, "qemu: Supported NICs: smc91c111\n");
Index: trunk/hw/mcf5208.c
===================================================================
--- trunk.orig/hw/mcf5208.c	2009-01-11 19:40:41.000000000 +0100
+++ trunk/hw/mcf5208.c	2009-01-11 19:40:49.000000000 +0100
@@ -242,8 +242,10 @@
         exit(1);
     }
     if (nd_table[0].vlan) {
-        if (nd_table[0].model == NULL
-            || strcmp(nd_table[0].model, "mcf_fec") == 0) {
+        if (nd_table[0].model == NULL) {
+            nd_table[0].model = "mcf_fec";
+        }
+        if (strcmp(nd_table[0].model, "mcf_fec") == 0) {
             mcf_fec_init(&nd_table[0], 0xfc030000, pic + 36);
         } else if (strcmp(nd_table[0].model, "?") == 0) {
             fprintf(stderr, "qemu: Supported NICs: mcf_fec\n");
Index: trunk/hw/mips_mipssim.c
===================================================================
--- trunk.orig/hw/mips_mipssim.c	2009-01-11 19:40:41.000000000 +0100
+++ trunk/hw/mips_mipssim.c	2009-01-11 19:40:49.000000000 +0100
@@ -176,8 +176,10 @@
         serial_init(0x3f8, env->irq[4], 115200, serial_hds[0]);
 
     if (nd_table[0].vlan) {
-        if (nd_table[0].model == NULL
-            || strcmp(nd_table[0].model, "mipsnet") == 0) {
+        if (nd_table[0].model == NULL) {
+            nd_table[0].model = "mipsnet";
+        }
+        if (strcmp(nd_table[0].model, "mipsnet") == 0) {
             /* MIPSnet uses the MIPS CPU INT0, which is interrupt 2. */
             mipsnet_init(0x4200, env->irq[2], &nd_table[0]);
         } else if (strcmp(nd_table[0].model, "?") == 0) {
Index: trunk/hw/mips_r4k.c
===================================================================
--- trunk.orig/hw/mips_r4k.c	2009-01-11 19:40:41.000000000 +0100
+++ trunk/hw/mips_r4k.c	2009-01-11 19:40:49.000000000 +0100
@@ -248,8 +248,8 @@
                  vga_ram_size);
 
     if (nd_table[0].vlan) {
-        if (nd_table[i].model == NULL) {
-	    nd_table[i].model = "ne2k_isa";
+        if (nd_table[0].model == NULL) {
+            nd_table[0].model = "ne2k_isa";
         }
         if (strcmp(nd_table[0].model, "ne2k_isa") == 0) {
             isa_ne2000_init(0x300, i8259[9], &nd_table[0]);
Index: trunk/hw/r2d.c
===================================================================
--- trunk.orig/hw/r2d.c	2009-01-11 19:47:36.000000000 +0100
+++ trunk/hw/r2d.c	2009-01-11 19:52:59.000000000 +0100
@@ -230,9 +230,13 @@
         drives_table[drive_get_index(IF_IDE, 0, 0)].bdrv, NULL);
 
     /* NIC: rtl8139 on-board, and 2 slots. */
+    nd_table[0].model = "rtl8139";
     pci_rtl8139_init(pci, &nd_table[0], 2 << 3);
-    for (i = 1; i < nb_nics; i++)
-        pci_nic_init(pci, &nd_table[i], -1);
+    for (i = 1; i < nb_nics; i++) {
+        if (nd_table[i].model != NULL) {
+            pci_nic_init(pci, &nd_table[i], -1);
+        }
+    }
 
     /* Todo: register on board registers */
     {

Re: [Qemu-devel] [BUG][PATCH] Fix a nullpointer crash caused by r6216

[Jean-Christophe PLAGNIOL-VILLARD]

On 19:55 Sun 11 Jan     , Stefan Weil wrote:
> Hi,
> 
> this patch tries to fix a nullpointer crash caused by r6216 (nd->model
> needs value != NULL).
> See also http://lists.gnu.org/archive/html/qemu-devel/2009-01/msg00257.html.
> 
> mips-r4k.c was already fixed but now contained a copy-paste bug (index i
> is wrong here).
> 
> Regards
> Stefan Weil
> 
> 

> fix nullpointer crash caused by r6216 (nd->model needs value != NULL)
> mips-r4k.c was already fixed but now contained a copy-paste bug
> 
> Signed-off-by: Stefan Weil <weil@mail.berlios.de>
> 
fix the r2dplus

Ack-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>

Best Regards,
J.