From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>

Coverity suspects nullptr-deref, because we don't check a return value
of virtio_snd_pcm_get_stream() call in virtio_snd_post_load().

While, techically this code has no issue it's better to change it and
as Peter has pointed out [1] just follow the same pattern as in other places
of virtio-snd code:
    for (uint32_t i = 0; i < vsnd->snd_conf.streams; i++) {
        VirtIOSoundPCMStream *stream = &vsnd->streams[i];
        ...
    }

this way it's perfectly clear that an index is always within the bounds.

Link: https://lore.kernel.org/qemu-devel/CAFEAcA-K7L5NWk0cC9R8yVvojSS6O6Eh+i9KXP8Lijo4Tjnd-Q@mail.gmail.com [1]
Resolves: Coverity CID 1687010
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
---
 hw/audio/virtio-snd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 6df7ea0eb0..fb22d79949 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1448,9 +1448,8 @@ static int virtio_snd_post_load(VirtIODevice *vdev)
     uint32_t i;
 
     for (i = 0; i < s->snd_conf.streams; i++) {
-        struct VirtIOSoundPCMStream *stream;
+        VirtIOSoundPCMStream *stream = &s->streams[i];
 
-        stream = virtio_snd_pcm_get_stream(s, i);
         if (virtio_snd_pcm_state_prepared(stream->state)) {
             virtio_snd_pcm_open(stream);
 
-- 
2.47.3

On Fri, 2 Oct 2026 at 17:50, Alexander Mikhalitsyn
<alexander@mihalicyn.com> wrote:
>
> From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
>
> Coverity suspects nullptr-deref, because we don't check a return value
> of virtio_snd_pcm_get_stream() call in virtio_snd_post_load().
>
> While, techically this code has no issue it's better to change it and
> as Peter has pointed out [1] just follow the same pattern as in other places
> of virtio-snd code:
>     for (uint32_t i = 0; i < vsnd->snd_conf.streams; i++) {
>         VirtIOSoundPCMStream *stream = &vsnd->streams[i];
>         ...
>     }
>
> this way it's perfectly clear that an index is always within the bounds.
>
> Link: https://lore.kernel.org/qemu-devel/CAFEAcA-K7L5NWk0cC9R8yVvojSS6O6Eh+i9KXP8Lijo4Tjnd-Q@mail.gmail.com [1]
> Resolves: Coverity CID 1687010
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

This patch doesn't seem to be upstream yet -- which maintainer takes
virtio-snd patches?

thanks
-- PMM

On Mon, 5 Oct 2026 at 10:13, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Fri, 2 Oct 2026 at 17:50, Alexander Mikhalitsyn
> <alexander@mihalicyn.com> wrote:
> >
> > From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
> >
> > Coverity suspects nullptr-deref, because we don't check a return value
> > of virtio_snd_pcm_get_stream() call in virtio_snd_post_load().
> >
> > While, techically this code has no issue it's better to change it and
> > as Peter has pointed out [1] just follow the same pattern as in other places
> > of virtio-snd code:
> >     for (uint32_t i = 0; i < vsnd->snd_conf.streams; i++) {
> >         VirtIOSoundPCMStream *stream = &vsnd->streams[i];
> >         ...
> >     }
> >
> > this way it's perfectly clear that an index is always within the bounds.
> >
> > Link: https://lore.kernel.org/qemu-devel/CAFEAcA-K7L5NWk0cC9R8yVvojSS6O6Eh+i9KXP8Lijo4Tjnd-Q@mail.gmail.com [1]
> > Resolves: Coverity CID 1687010
> > Reported-by: Peter Maydell <peter.maydell@linaro.org>
> > Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
>
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

On Mon, Oct 19, 2026 at 11:05:32AM +0100, Peter Maydell wrote:
> This patch doesn't seem to be upstream yet -- which maintainer takes
> virtio-snd patches?
> 
> thanks
> -- PMM

I can take it since no one else did.

> On Mon, 5 Oct 2026 at 10:13, Peter Maydell <peter.maydell@linaro.org> wrote:
> >
> > On Fri, 2 Oct 2026 at 17:50, Alexander Mikhalitsyn
> > <alexander@mihalicyn.com> wrote:
> > >
> > > From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
> > >
> > > Coverity suspects nullptr-deref, because we don't check a return value
> > > of virtio_snd_pcm_get_stream() call in virtio_snd_post_load().
> > >
> > > While, techically this code has no issue it's better to change it and
> > > as Peter has pointed out [1] just follow the same pattern as in other places
> > > of virtio-snd code:
> > >     for (uint32_t i = 0; i < vsnd->snd_conf.streams; i++) {
> > >         VirtIOSoundPCMStream *stream = &vsnd->streams[i];
> > >         ...
> > >     }
> > >
> > > this way it's perfectly clear that an index is always within the bounds.
> > >
> > > Link: https://lore.kernel.org/qemu-devel/CAFEAcA-K7L5NWk0cC9R8yVvojSS6O6Eh+i9KXP8Lijo4Tjnd-Q@mail.gmail.com [1]
> > > Resolves: Coverity CID 1687010
> > > Reported-by: Peter Maydell <peter.maydell@linaro.org>
> > > Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
> >
> > Reviewed-by: Peter Maydell <peter.maydell@linaro.org>