[Qemu-devel] [PATCH] spapr: ensure core_slot isn't NULL in spapr_core_unplug()

[Qemu-devel] [PATCH] spapr: ensure core_slot isn't NULL in spapr_core_unplug()

[Greg Kurz]

If we go that far on the path of hot-removing a core and we find out that
the core-id is invalid, then we have a serious bug.

Let's make it explicit with an assert() instead of dereferencing a NULL
pointer.

This fixes Coverity issue CID 1375404.

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/spapr.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 0980d733cd7a..1c5b814fc0bf 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2715,6 +2715,7 @@ static void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     CPUCore *cc = CPU_CORE(dev);
     CPUArchId *core_slot = spapr_find_cpu_slot(ms, cc->core_id, NULL);
 
+    assert(core_slot);
     core_slot->cpu = NULL;
     object_unparent(OBJECT(dev));
 }

Re: [Qemu-devel] [PATCH] spapr: ensure core_slot isn't NULL in spapr_core_unplug()

[Igor Mammedov]

On Thu, 18 May 2017 15:58:31 +0200
Greg Kurz <groug@kaod.org> wrote:

> If we go that far on the path of hot-removing a core and we find out that
> the core-id is invalid, then we have a serious bug.
> 
> Let's make it explicit with an assert() instead of dereferencing a NULL
> pointer.
> 
> This fixes Coverity issue CID 1375404.
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>

> ---
>  hw/ppc/spapr.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 0980d733cd7a..1c5b814fc0bf 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -2715,6 +2715,7 @@ static void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
>      CPUCore *cc = CPU_CORE(dev);
>      CPUArchId *core_slot = spapr_find_cpu_slot(ms, cc->core_id, NULL);
>  
> +    assert(core_slot);
>      core_slot->cpu = NULL;
>      object_unparent(OBJECT(dev));
>  }
> 
> 

Re: [Qemu-devel] [PATCH] spapr: ensure core_slot isn't NULL in spapr_core_unplug()

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1141 bytes --]

On Thu, May 18, 2017 at 03:58:31PM +0200, Greg Kurz wrote:
> If we go that far on the path of hot-removing a core and we find out that
> the core-id is invalid, then we have a serious bug.
> 
> Let's make it explicit with an assert() instead of dereferencing a NULL
> pointer.
> 
> This fixes Coverity issue CID 1375404.
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Merged to ppc-for-2.10.

> ---
>  hw/ppc/spapr.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 0980d733cd7a..1c5b814fc0bf 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -2715,6 +2715,7 @@ static void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
>      CPUCore *cc = CPU_CORE(dev);
>      CPUArchId *core_slot = spapr_find_cpu_slot(ms, cc->core_id, NULL);
>  
> +    assert(core_slot);
>      core_slot->cpu = NULL;
>      object_unparent(OBJECT(dev));
>  }
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]