From fa66b909f382619da15f8c7e323145adfa94fdac Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 25 Jun 2010 18:53:21 +0200 Subject: scsi: scsi_bus_legacy_handle_cmdline() can fail, fix callers None of its callers checks for failure. scsi_hot_add() can crash because of that: (qemu) drive_add 4 if=scsi,format=host_device,file=/dev/sg1 scsi-generic: scsi generic interface too old Segmentation fault (core dumped) Fix all callers, not just scsi_hot_add(). Signed-off-by: Markus Armbruster Signed-off-by: Kevin Wolf --- hw/scsi-bus.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'hw/scsi-bus.c') diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c index 24bd060..d5b66c1 100644 --- a/hw/scsi-bus.c +++ b/hw/scsi-bus.c @@ -83,7 +83,6 @@ void scsi_qdev_register(SCSIDeviceInfo *info) } /* handle legacy '-drive if=scsi,...' cmd line args */ -/* FIXME callers should check for failure, but don't */ SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, DriveInfo *dinfo, int unit) { const char *driver; @@ -98,18 +97,22 @@ SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, DriveInfo *dinfo, int unit) return DO_UPCAST(SCSIDevice, qdev, dev); } -void scsi_bus_legacy_handle_cmdline(SCSIBus *bus) +int scsi_bus_legacy_handle_cmdline(SCSIBus *bus) { DriveInfo *dinfo; - int unit; + int res = 0, unit; for (unit = 0; unit < MAX_SCSI_DEVS; unit++) { dinfo = drive_get(IF_SCSI, bus->busnr, unit); if (dinfo == NULL) { continue; } - scsi_bus_legacy_add_drive(bus, dinfo, unit); + if (!scsi_bus_legacy_add_drive(bus, dinfo, unit)) { + res = -1; + break; + } } + return res; } void scsi_dev_clear_sense(SCSIDevice *dev) -- cgit v1.1