diff options
| author | Markus Armbruster <armbru@redhat.com> | 2020-06-30 11:03:45 +0200 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2020-07-02 11:54:17 +0200 |
| commit | 18d588fe1e178b43203532a2debdffd4f36535c5 (patch) | |
| tree | 507cf9c4cc1817dd9050b93736ca89ede04f45dc /hw/i386 | |
| parent | 81f66cfd24ccd2645b19366d768a72f20ea3838b (diff) | |
| download | qemu-18d588fe1e178b43203532a2debdffd4f36535c5.zip qemu-18d588fe1e178b43203532a2debdffd4f36535c5.tar.gz qemu-18d588fe1e178b43203532a2debdffd4f36535c5.tar.bz2 | |
x86: Fix x86_cpu_new() error handling
The Error ** argument must be NULL, &error_abort, &error_fatal, or a
pointer to a variable containing NULL. Passing an argument of the
latter kind twice without clearing it in between is wrong: if the
first call sets an error, it no longer points to NULL for the second
call.
x86_cpu_new() is wrong that way: it passes &local_err to
object_property_set_uint() without checking it, and then to
qdev_realize(). If both fail, we'll trip error_setv()'s assertion.
To assess the bug's impact, we'd need to figure out how to make both
calls fail. Too much work for ignorant me, sorry.
Fix by checking for failure right away.
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20200630090351.1247703-21-armbru@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/i386')
| -rw-r--r-- | hw/i386/x86.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/hw/i386/x86.c b/hw/i386/x86.c index 34229b4..93f7371 100644 --- a/hw/i386/x86.c +++ b/hw/i386/x86.c @@ -118,14 +118,16 @@ uint32_t x86_cpu_apic_id_from_index(X86MachineState *x86ms, void x86_cpu_new(X86MachineState *x86ms, int64_t apic_id, Error **errp) { - Object *cpu = NULL; Error *local_err = NULL; - - cpu = object_new(MACHINE(x86ms)->cpu_type); + Object *cpu = object_new(MACHINE(x86ms)->cpu_type); object_property_set_uint(cpu, apic_id, "apic-id", &local_err); + if (local_err) { + goto out; + } qdev_realize(DEVICE(cpu), NULL, &local_err); +out: object_unref(cpu); error_propagate(errp, local_err); } |