aboutsummaryrefslogtreecommitdiff
path: root/audio/dsound_template.h
diff options
context:
space:
mode:
authorDaniel Henrique Barboza <danielhb413@gmail.com>2022-04-09 17:08:56 -0300
committerDaniel Henrique Barboza <danielhb413@gmail.com>2022-07-28 10:31:54 -0300
commitedccf661e6205d5ffff73860ab22eaf08a611ad9 (patch)
treeaa4480e68612129eb0e2ad12cf02e3ba24aa5af6 /audio/dsound_template.h
parent3e4abe2c92964aadd35344a635b0f32cb487fd5c (diff)
downloadqemu-edccf661e6205d5ffff73860ab22eaf08a611ad9.zip
qemu-edccf661e6205d5ffff73860ab22eaf08a611ad9.tar.gz
qemu-edccf661e6205d5ffff73860ab22eaf08a611ad9.tar.bz2
hw/ppc: check if spapr_drc_index() returns NULL in spapr_nvdimm.c
spapr_nvdimm_flush_completion_cb() and flush_worker_cb() are using the DRC object returned by spapr_drc_index() without checking it for NULL. In this case we would be dereferencing a NULL pointer when doing SPAPR_NVDIMM(drc->dev) and PC_DIMM(drc->dev). This can happen if, during a scm_flush(), the DRC object is wrongly freed/released (e.g. a bug in another part of the code). spapr_drc_index() would then return NULL in the callbacks. Fixes: Coverity CID 1487108, 1487178 Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20220409200856.283076-2-danielhb413@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Diffstat (limited to 'audio/dsound_template.h')
0 files changed, 0 insertions, 0 deletions