From: Prasad J Pandit <pjp@fedoraproject.org>

When registering a MemoryRegionOps object, assert that its
read/write callback methods are defined. This avoids potential
guest crash via a NULL pointer dereference.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 memory.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Update v3: Add Reviewed-by: ...
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09467.html

diff --git a/memory.c b/memory.c
index 9200b20130..5e22bce326 100644
--- a/memory.c
+++ b/memory.c
@@ -1485,7 +1485,13 @@ void memory_region_init_io(MemoryRegion *mr,
                            uint64_t size)
 {
     memory_region_init(mr, owner, name, size);
-    mr->ops = ops ? ops : &unassigned_mem_ops;
+    if (ops) {
+        assert(ops->read || ops->read_with_attrs);
+        assert(ops->write || ops->write_with_attrs);
+        mr->ops = ops;
+    } else {
+        mr->ops = &unassigned_mem_ops;
+    }
     mr->opaque = opaque;
     mr->terminates = true;
 }
@@ -1663,6 +1669,8 @@ void memory_region_init_rom_device_nomigrate(MemoryRegion *mr,
 {
     Error *err = NULL;
     assert(ops);
+    assert(ops->read || ops->read_with_attrs);
+    assert(ops->write || ops->write_with_attrs);
     memory_region_init(mr, owner, name, size);
     mr->ops = ops;
     mr->opaque = opaque;
-- 
2.26.2

On Tue, 30 Jun 2020 at 13:31, P J P <ppandit@redhat.com> wrote:
>
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When registering a MemoryRegionOps object, assert that its
> read/write callback methods are defined. This avoids potential
> guest crash via a NULL pointer dereference.
>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Reviewed-by: Li Qiang <liq3ea@gmail.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM