aboutsummaryrefslogtreecommitdiff
path: root/hw/avr/arduino.c
diff options
context:
space:
mode:
authorStefano Garzarella <sgarzare@redhat.com>2025-07-14 12:11:56 +0200
committerMichael S. Tsirkin <mst@redhat.com>2025-08-01 10:23:50 -0400
commit4caf74916d09019e61c91f8cb1166510836d35e8 (patch)
tree40ad46a96615835bc0d16006c9a940152f66265c /hw/avr/arduino.c
parent4164adc476d85d46ef4901c05a9807b24473b00d (diff)
downloadqemu-4caf74916d09019e61c91f8cb1166510836d35e8.zip
qemu-4caf74916d09019e61c91f8cb1166510836d35e8.tar.gz
qemu-4caf74916d09019e61c91f8cb1166510836d35e8.tar.bz2
net/vdpa: fix potential fd leak in net_init_vhost_vdpa()
Coverity reported a file descriptor leak (CID 1490785) that happens if `vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case net_host_vdpa_init(), which should take ownership of the fd, is never called. vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not negotiated, or a negative error if the ioctl() fails, or the maximum number of queue pairs exposed by the device in the config space in the `max_virtqueue_pairs` field. In the VIRTIO spec we have: The device MUST set max_virtqueue_pairs to between 1 and 0x8000 inclusive, if it offers VIRTIO_NET_F_MQ. So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an error since the device is violating the VIRTIO spec. Treat also `queue_pairs == 0` as an error, and jump to the `err` label, to return a negative value to the caller in any case. Coverity: CID 1490785 Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20250714101156.30024-1-sgarzare@redhat.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Acked-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/avr/arduino.c')
0 files changed, 0 insertions, 0 deletions