When getting the 'pbdev', the if...else has no default branch.
From Coverity, the 'pbdev' maybe null when the 'dev' is not
the TYPE_PCI_BRIDGE/TYPE_PCI_DEVICE/TYPE_S390_PCI_DEVICE.
Spotted by Coverity: CID 1398593
Signed-off-by: Li Qiang <liq3ea@163.com>
---
hw/s390x/s390-pci-bus.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 15759b6514..b3122268a3 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -956,6 +956,10 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
} else if (object_dynamic_cast(OBJECT(dev), TYPE_S390_PCI_DEVICE)) {
pbdev = S390_PCI_DEVICE(dev);
pci_dev = pbdev->pdev;
+ } else {
+ error_setg(errp, "s390: device unplug for not supported device"
+ " type: %s", object_get_typename(OBJECT(dev)));
+ return;
}
switch (pbdev->state) {
--
2.17.1
On Thu, 3 Jan 2019 06:02:46 -0800 Li Qiang <liq3ea@163.com> wrote: > When getting the 'pbdev', the if...else has no default branch. > From Coverity, the 'pbdev' maybe null when the 'dev' is not > the TYPE_PCI_BRIDGE/TYPE_PCI_DEVICE/TYPE_S390_PCI_DEVICE. > > Spotted by Coverity: CID 1398593 > > Signed-off-by: Li Qiang <liq3ea@163.com> > --- > hw/s390x/s390-pci-bus.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c > index 15759b6514..b3122268a3 100644 > --- a/hw/s390x/s390-pci-bus.c > +++ b/hw/s390x/s390-pci-bus.c > @@ -956,6 +956,10 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, > } else if (object_dynamic_cast(OBJECT(dev), TYPE_S390_PCI_DEVICE)) { > pbdev = S390_PCI_DEVICE(dev); > pci_dev = pbdev->pdev; > + } else { > + error_setg(errp, "s390: device unplug for not supported device" > + " type: %s", object_get_typename(OBJECT(dev))); > + return; I think that is something that really Should Not Happen. However, looking at s390_pcihost_plug, we just do nothing if the plugged device does not match any of the expected three values. Maybe we should also set an error in that case there? > } > > switch (pbdev->state) {
I’m inspired by the function ‘ich9_pm_device_unplug_cb’. From the ‘plug’ ich9_pm_device_plug_cb it set an error. So I think we can also set this is this s390 device plug. I will send out revised patch soon. Thanks, Li Qiang 发件人: Cornelia Huck 发送时间: 2019年1月3日 22:54 收件人: Li Qiang 抄送: walling@linux.ibm.com; rth@twiddle.net; david@redhat.com; pasic@linux.ibm.com; borntraeger@de.ibm.com; qemu-s390x@nongnu.org; qemu-devel@nongnu.org; peter.maydell@linaro.org; Pierre Morel 主题: Re: [PATCH] s390: avoid potential null dereference ins390_pcihost_unplug() On Thu, 3 Jan 2019 06:02:46 -0800 Li Qiang <liq3ea@163.com> wrote: > When getting the 'pbdev', the if...else has no default branch. > From Coverity, the 'pbdev' maybe null when the 'dev' is not > the TYPE_PCI_BRIDGE/TYPE_PCI_DEVICE/TYPE_S390_PCI_DEVICE. > > Spotted by Coverity: CID 1398593 > > Signed-off-by: Li Qiang <liq3ea@163.com> > --- > hw/s390x/s390-pci-bus.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c > index 15759b6514..b3122268a3 100644 > --- a/hw/s390x/s390-pci-bus.c > +++ b/hw/s390x/s390-pci-bus.c > @@ -956,6 +956,10 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, > } else if (object_dynamic_cast(OBJECT(dev), TYPE_S390_PCI_DEVICE)) { > pbdev = S390_PCI_DEVICE(dev); > pci_dev = pbdev->pdev; > + } else { > + error_setg(errp, "s390: device unplug for not supported device" > + " type: %s", object_get_typename(OBJECT(dev))); > + return; I think that is something that really Should Not Happen. However, looking at s390_pcihost_plug, we just do nothing if the plugged device does not match any of the expected three values. Maybe we should also set an error in that case there? > } > > switch (pbdev->state) {
On Thu, 3 Jan 2019 15:54:38 +0100 Cornelia Huck <cohuck@redhat.com> wrote: > On Thu, 3 Jan 2019 06:02:46 -0800 > Li Qiang <liq3ea@163.com> wrote: > > > When getting the 'pbdev', the if...else has no default branch. > > From Coverity, the 'pbdev' maybe null when the 'dev' is not > > the TYPE_PCI_BRIDGE/TYPE_PCI_DEVICE/TYPE_S390_PCI_DEVICE. > > > > Spotted by Coverity: CID 1398593 > > > > Signed-off-by: Li Qiang <liq3ea@163.com> > > --- > > hw/s390x/s390-pci-bus.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c > > index 15759b6514..b3122268a3 100644 > > --- a/hw/s390x/s390-pci-bus.c > > +++ b/hw/s390x/s390-pci-bus.c > > @@ -956,6 +956,10 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, > > } else if (object_dynamic_cast(OBJECT(dev), TYPE_S390_PCI_DEVICE)) { > > pbdev = S390_PCI_DEVICE(dev); > > pci_dev = pbdev->pdev; > > + } else { > > + error_setg(errp, "s390: device unplug for not supported device" > > + " type: %s", object_get_typename(OBJECT(dev))); > > + return; > > I think that is something that really Should Not Happen. However, > looking at s390_pcihost_plug, we just do nothing if the plugged device > does not match any of the expected three values. Maybe we should also > set an error in that case there? > Really Should Not Happen is in this case a programming error AFAIU. Wouldn't something more assert like reflect that better? > > } > > > > switch (pbdev->state) { > >
© 2016 - 2024 Red Hat, Inc.