From nobody Sat Apr 5 15:46:23 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1738051322195640.4975275636597; Tue, 28 Jan 2025 00:02:02 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tcgPg-0000xj-Bh; Tue, 28 Jan 2025 02:53:36 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tcgPf-0000x4-4c; Tue, 28 Jan 2025 02:53:35 -0500 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tcgPd-0007np-Cw; Tue, 28 Jan 2025 02:53:34 -0500 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AE979E1ABF; Tue, 28 Jan 2025 10:52:59 +0300 (MSK) Received: from localhost.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 295C01A62AE; Tue, 28 Jan 2025 10:53:25 +0300 (MSK) Received: by localhost.tls.msk.ru (Postfix, from userid 1000) id 178D651FF3; Tue, 28 Jan 2025 10:53:25 +0300 (MSK) To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Peter Maydell , Paolo Bonzini , Markus Armbruster , Michael Tokarev Subject: [Stable-7.2.16 06/31] qdev: Fix set_pci_devfn() to visit option only once Date: Tue, 28 Jan 2025 00:40:58 +0300 Message-Id: <20250127214124.3730126-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Michael Tokarev Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -53 X-Spam_score: -5.4 X-Spam_bar: ----- X-Spam_report: (-5.4 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_06_12=1.543, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1738051324180019000 Content-Type: text/plain; charset="utf-8" pci_devfn properties accept either a string or an integer as input. To implement this, set_pci_devfn() first tries to visit the option as a string, and if that fails, it visits it as an integer instead. While the QemuOpts visitor happens to accept this, it is invalid according to the visitor interface. QObject input visitors run into an assertion failure when this is done. QObject input visitors are used with the JSON syntax version of -device on the command line: $ ./qemu-system-x86_64 -enable-kvm -M q35 -device pcie-pci-bridge,id=3Dpci.= 1,bus=3Dpcie.0 -blockdev null-co,node-name=3Ddisk -device '{ "driver": "vir= tio-blk-pci", "drive": "disk", "id": "virtio-disk0", "bus": "pci.1", "addr"= : 1 }' qemu-system-x86_64: ../qapi/qobject-input-visitor.c:143: QObject *qobject_i= nput_try_get_object(QObjectInputVisitor *, const char *, _Bool): Assertion = `removed' failed. The proper way to accept both strings and integers is using the alternate mechanism, which tells us the type of the input before it's visited. With this information, we can directly visit it as the right type. This fixes set_pci_devfn() by using the alternate mechanism. Cc: qemu-stable@nongnu.org Reported-by: Peter Maydell Signed-off-by: Kevin Wolf Message-ID: <20241119120353.57812-1-kwolf@redhat.com> Acked-by: Paolo Bonzini Reviewed-by: Markus Armbruster Signed-off-by: Kevin Wolf (cherry picked from commit 5102f9df4a9a7adfbd902f9515c3f8f53dba288e) Signed-off-by: Michael Tokarev diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-sys= tem.c index a91f60567a..d350789e76 100644 --- a/hw/core/qdev-properties-system.c +++ b/hw/core/qdev-properties-system.c @@ -740,39 +740,57 @@ static void set_pci_devfn(Object *obj, Visitor *v, co= nst char *name, void *opaque, Error **errp) { Property *prop =3D opaque; + g_autofree GenericAlternate *alt; int32_t value, *ptr =3D object_field_prop_ptr(obj, prop); unsigned int slot, fn, n; - char *str; + g_autofree char *str =3D NULL; + + if (!visit_start_alternate(v, name, &alt, sizeof(*alt), errp)) { + return; + } + + switch (alt->type) { + case QTYPE_QSTRING: + if (!visit_type_str(v, name, &str, errp)) { + goto out; + } + + if (sscanf(str, "%x.%x%n", &slot, &fn, &n) !=3D 2) { + fn =3D 0; + if (sscanf(str, "%x%n", &slot, &n) !=3D 1) { + goto invalid; + } + } + if (str[n] !=3D '\0' || fn > 7 || slot > 31) { + goto invalid; + } + *ptr =3D slot << 3 | fn; + break; =20 - if (!visit_type_str(v, name, &str, NULL)) { + case QTYPE_QNUM: if (!visit_type_int32(v, name, &value, errp)) { - return; + goto out; } if (value < -1 || value > 255) { error_setg(errp, QERR_INVALID_PARAMETER_VALUE, name ? name : "null", "a value between -1 and 255"); - return; + goto out; } *ptr =3D value; - return; - } + break; =20 - if (sscanf(str, "%x.%x%n", &slot, &fn, &n) !=3D 2) { - fn =3D 0; - if (sscanf(str, "%x%n", &slot, &n) !=3D 1) { - goto invalid; - } - } - if (str[n] !=3D '\0' || fn > 7 || slot > 31) { - goto invalid; + default: + error_setg(errp, "Invalid parameter type for '%s', expected int or= str", + name ? name : "null"); + goto out; } - *ptr =3D slot << 3 | fn; - g_free(str); - return; + + goto out; =20 invalid: error_set_from_qdev_prop_error(errp, EINVAL, obj, name, str); - g_free(str); +out: + visit_end_alternate(v, (void **) &alt); } =20 static int print_pci_devfn(Object *obj, Property *prop, char *dest, --=20 2.39.5