[PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[Sergei Heifetz]

The check that xcc->model is not NULL occurs after it is dereferenced
inside x86_cpu_get_versioned_cache_info(), so something like
`-cpu host,legacy-cache=off` leads to a segfault rather than an error.
This patch fixes that.

Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com>
---
 target/i386/cpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 01b64940b1..00645e1149 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -10023,8 +10023,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 
     /* Cache information initialization */
     if (!cpu->legacy_cache) {
-        const CPUCaches *cache_info =
-            x86_cpu_get_versioned_cache_info(cpu, xcc->model);
+        const CPUCaches *cache_info = xcc->model
+            ? x86_cpu_get_versioned_cache_info(cpu, xcc->model)
+            : NULL;
 
         if (!xcc->model || !cache_info) {
             g_autofree char *name = x86_cpu_class_get_model_name(xcc);
-- 
2.34.1

Re: [PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[Vladimir Sementsov-Ogievskiy]

On 05.03.26 09:04, Sergei Heifetz wrote:
> The check that xcc->model is not NULL occurs after it is dereferenced
> inside x86_cpu_get_versioned_cache_info(), so something like
> `-cpu host,legacy-cache=off` leads to a segfault rather than an error.
> This patch fixes that.
> 
> Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
> Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com>
> ---
>   target/i386/cpu.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 01b64940b1..00645e1149 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -10023,8 +10023,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>   
>       /* Cache information initialization */
>       if (!cpu->legacy_cache) {
> -        const CPUCaches *cache_info =
> -            x86_cpu_get_versioned_cache_info(cpu, xcc->model);
> +        const CPUCaches *cache_info = xcc->model
> +            ? x86_cpu_get_versioned_cache_info(cpu, xcc->model)
> +            : NULL;
>   
>           if (!xcc->model || !cache_info) {
>               g_autofree char *name = x86_cpu_class_get_model_name(xcc);

Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>


-- 
Best regards,
Vladimir

Re: [PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[Zhao Liu]

On Thu, Mar 05, 2026 at 11:04:31AM +0500, Sergei Heifetz wrote:
> Date: Thu,  5 Mar 2026 11:04:31 +0500
> From: Sergei Heifetz <heifetz@yandex-team.com>
> Subject: [PATCH] target/i386: fix NULL pointer dereference in
>  legacy-cache=off handling
> X-Mailer: git-send-email 2.34.1
> 
> The check that xcc->model is not NULL occurs after it is dereferenced
> inside x86_cpu_get_versioned_cache_info(), so something like
> `-cpu host,legacy-cache=off` leads to a segfault rather than an error.
> This patch fixes that.
> 
> Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
> Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com>
> ---
>  target/i386/cpu.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

Re: [PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[Michael Tokarev]

On 05.03.2026 09:04, Sergei Heifetz wrote:
> The check that xcc->model is not NULL occurs after it is dereferenced
> inside x86_cpu_get_versioned_cache_info(), so something like
> `-cpu host,legacy-cache=off` leads to a segfault rather than an error.
> This patch fixes that.
> 
> Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
> Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com>
> ---
>   target/i386/cpu.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 01b64940b1..00645e1149 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -10023,8 +10023,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>   
>       /* Cache information initialization */
>       if (!cpu->legacy_cache) {
> -        const CPUCaches *cache_info =
> -            x86_cpu_get_versioned_cache_info(cpu, xcc->model);
> +        const CPUCaches *cache_info = xcc->model
> +            ? x86_cpu_get_versioned_cache_info(cpu, xcc->model)
> +            : NULL;
>   
>           if (!xcc->model || !cache_info) {
>               g_autofree char *name = x86_cpu_class_get_model_name(xcc);

With this cache_info init, the condition in the next line can be
simplified to just (!cache_info).  Dunno if it's worth the effort
though.  I can fold this change into the patch at apply time if you're
ok with it.

Thanks,

/mjt

Re: [PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

[Sergei Heifetz]

On Wed Mar 11, 2026 at 3:51 PM +05, Michael Tokarev wrote:
> On 05.03.2026 09:04, Sergei Heifetz wrote:
>> The check that xcc->model is not NULL occurs after it is dereferenced
>> inside x86_cpu_get_versioned_cache_info(), so something like
>> `-cpu host,legacy-cache=off` leads to a segfault rather than an error.
>> This patch fixes that.
>> 
>> Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
>> Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com>
>> ---
>>   target/i386/cpu.c | 5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>> 
>> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
>> index 01b64940b1..00645e1149 100644
>> --- a/target/i386/cpu.c
>> +++ b/target/i386/cpu.c
>> @@ -10023,8 +10023,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>   
>>       /* Cache information initialization */
>>       if (!cpu->legacy_cache) {
>> -        const CPUCaches *cache_info =
>> -            x86_cpu_get_versioned_cache_info(cpu, xcc->model);
>> +        const CPUCaches *cache_info = xcc->model
>> +            ? x86_cpu_get_versioned_cache_info(cpu, xcc->model)
>> +            : NULL;
>>   
>>           if (!xcc->model || !cache_info) {
>>               g_autofree char *name = x86_cpu_class_get_model_name(xcc);
>
> With this cache_info init, the condition in the next line can be
> simplified to just (!cache_info). 

Sure.

> Dunno if it's worth the effort though.  I can fold this change into the
> patch at apply time if you're ok with it.

I'm fine with that if it's easier for you that way. Thank you.