From 651b386205d7578e8de60df0ec3830b315f6686f Mon Sep 17 00:00:00 2001 From: Nicholas Piggin Date: Wed, 28 Aug 2024 14:33:34 +1000 Subject: [PATCH 1/2] chardev: Fix record/replay error path NULL deref in device creation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit qemu_chardev_set_replay() was being called in chardev creation to set up replay parameters even if the chardev is NULL. A segfault can be reproduced by specifying '-serial chardev:bad' with an rr=record mode. Fix this with a NULL pointer check. Reported-by: Peter Maydell Resolves: Coverity CID 1559470 Fixes: 4c193bb129dae ("chardev: set record/replay on the base device of a muxed device") Signed-off-by: Nicholas Piggin Reviewed-by: Marc-André Lureau Reviewed-by: Peter Maydell Message-ID: <20240828043337.14587-2-npiggin@gmail.com> --- chardev/char.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chardev/char.c b/chardev/char.c index a1722aa076..1c7f6c711a 100644 --- a/chardev/char.c +++ b/chardev/char.c @@ -726,7 +726,7 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename, if (strstart(filename, "chardev:", &p)) { chr = qemu_chr_find(p); - if (replay) { + if (replay && chr) { qemu_chardev_set_replay(chr, &err); if (err) { error_report_err(err); From 3c8ab23fb30328111304cb8eab9bda769d52048f Mon Sep 17 00:00:00 2001 From: Nicholas Piggin Date: Wed, 28 Aug 2024 14:33:35 +1000 Subject: [PATCH 2/2] chardev: Remove __-prefixed names MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Peter points out double underscore prefix names tend to be reserved for the system. Clean these up. Suggested-by: Peter Maydell Signed-off-by: Nicholas Piggin Reviewed-by: Marc-André Lureau Reviewed-by: Peter Maydell Message-ID: <20240828043337.14587-3-npiggin@gmail.com> --- chardev/char.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/chardev/char.c b/chardev/char.c index 1c7f6c711a..d06698228a 100644 --- a/chardev/char.c +++ b/chardev/char.c @@ -633,8 +633,8 @@ static void qemu_chardev_set_replay(Chardev *chr, Error **errp) } } -static Chardev *__qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context, - bool replay, Error **errp) +static Chardev *do_qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context, + bool replay, Error **errp) { const ChardevClass *cc; Chardev *base = NULL, *chr = NULL; @@ -712,12 +712,12 @@ Chardev *qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context, Error **errp) { /* XXX: should this really not record/replay? */ - return __qemu_chr_new_from_opts(opts, context, false, errp); + return do_qemu_chr_new_from_opts(opts, context, false, errp); } -static Chardev *__qemu_chr_new(const char *label, const char *filename, - bool permit_mux_mon, GMainContext *context, - bool replay) +static Chardev *qemu_chr_new_from_name(const char *label, const char *filename, + bool permit_mux_mon, + GMainContext *context, bool replay) { const char *p; Chardev *chr; @@ -740,7 +740,7 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename, if (!opts) return NULL; - chr = __qemu_chr_new_from_opts(opts, context, replay, &err); + chr = do_qemu_chr_new_from_opts(opts, context, replay, &err); if (!chr) { error_report_err(err); goto out; @@ -765,7 +765,8 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename, Chardev *qemu_chr_new_noreplay(const char *label, const char *filename, bool permit_mux_mon, GMainContext *context) { - return __qemu_chr_new(label, filename, permit_mux_mon, context, false); + return qemu_chr_new_from_name(label, filename, permit_mux_mon, context, + false); } static Chardev *qemu_chr_new_permit_mux_mon(const char *label, @@ -773,7 +774,8 @@ static Chardev *qemu_chr_new_permit_mux_mon(const char *label, bool permit_mux_mon, GMainContext *context) { - return __qemu_chr_new(label, filename, permit_mux_mon, context, true); + return qemu_chr_new_from_name(label, filename, permit_mux_mon, context, + true); } Chardev *qemu_chr_new(const char *label, const char *filename,