qdev_get_clocklist() function returns a pointer to the NamedClockList
struct. This function is called in qdev_alias_clock() and the returned
pointer is immediately dereferenced without a null check.

Passing clock name that doesn't exist to qdev_get_clocklist() is a
programming error, and so this change is not fixing a bug, only making
the reporting of that programming error a bit more helpful and bringing
it in to line with qdev_get_clock_in() and qdev_get_clock_out().

Cc: luc@lmichel.fr
Cc: peter.maydell@linaro.org
Cc: hemanshu_dev@proton.me
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2342
Signed-off-by: hemanshu.khilari.foss <hemanshu.khilari.foss@gmail.com>
---
 hw/core/qdev-clock.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/core/qdev-clock.c b/hw/core/qdev-clock.c
index 6e2967e433..861f78f94c 100644
--- a/hw/core/qdev-clock.c
+++ b/hw/core/qdev-clock.c
@@ -157,7 +157,14 @@ Clock *qdev_alias_clock(DeviceState *dev, const char *name,
                         DeviceState *alias_dev, const char *alias_name)
 {
     NamedClockList *ncl = qdev_get_clocklist(dev, name);
-    Clock *clk = ncl->clock;
+    Clock *clk;
+
+    if (!ncl) {
+        error_report("Can not find clock '%s' for device type '%s'",
+                     name, object_get_typename(OBJECT(dev)));
+        abort();
+    }
+    clk = ncl->clock;
 
     ncl = qdev_init_clocklist(alias_dev, alias_name, true, ncl->output, clk);
 
-- 
2.42.0

On 21:03 Sun 31 May     , hemanshu.khilari.foss wrote:
> qdev_get_clocklist() function returns a pointer to the NamedClockList
> struct. This function is called in qdev_alias_clock() and the returned
> pointer is immediately dereferenced without a null check.
> 
> Passing clock name that doesn't exist to qdev_get_clocklist() is a
> programming error, and so this change is not fixing a bug, only making
> the reporting of that programming error a bit more helpful and bringing
> it in to line with qdev_get_clock_in() and qdev_get_clock_out().
> 
> Cc: luc@lmichel.fr
> Cc: peter.maydell@linaro.org
> Cc: hemanshu_dev@proton.me
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2342
> Signed-off-by: hemanshu.khilari.foss <hemanshu.khilari.foss@gmail.com>

Reviewed-by: Luc Michel <luc@lmichel.fr>

> ---
>  hw/core/qdev-clock.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/core/qdev-clock.c b/hw/core/qdev-clock.c
> index 6e2967e433..861f78f94c 100644
> --- a/hw/core/qdev-clock.c
> +++ b/hw/core/qdev-clock.c
> @@ -157,7 +157,14 @@ Clock *qdev_alias_clock(DeviceState *dev, const char *name,
>                          DeviceState *alias_dev, const char *alias_name)
>  {
>      NamedClockList *ncl = qdev_get_clocklist(dev, name);
> -    Clock *clk = ncl->clock;
> +    Clock *clk;
> +
> +    if (!ncl) {
> +        error_report("Can not find clock '%s' for device type '%s'",
> +                     name, object_get_typename(OBJECT(dev)));
> +        abort();
> +    }
> +    clk = ncl->clock;
>  
>      ncl = qdev_init_clocklist(alias_dev, alias_name, true, ncl->output, clk);
>  
> -- 
> 2.42.0
> 

--

On Sun, 31 May 2026 at 16:34, hemanshu.khilari.foss
<hemanshu.khilari.foss@gmail.com> wrote:
>
> qdev_get_clocklist() function returns a pointer to the NamedClockList
> struct. This function is called in qdev_alias_clock() and the returned
> pointer is immediately dereferenced without a null check.
>
> Passing clock name that doesn't exist to qdev_get_clocklist() is a
> programming error, and so this change is not fixing a bug, only making
> the reporting of that programming error a bit more helpful and bringing
> it in to line with qdev_get_clock_in() and qdev_get_clock_out().
>
> Cc: luc@lmichel.fr
> Cc: peter.maydell@linaro.org
> Cc: hemanshu_dev@proton.me
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2342
> Signed-off-by: hemanshu.khilari.foss <hemanshu.khilari.foss@gmail.com>
> ---

Thanks for this patch -- I've applied it to my target-arm.next
tree, so it will get upstream in a week or two.

-- PMM