From nobody Sat Sep 26 20:52:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=swemel.ru ARC-Seal: i=1; a=rsa-sha256; t=1789489518; cv=none; d=zohomail.com; s=zohoarc; b=T0RoJ/cpBs4ZfKhagttqCTHNCf2E4kC2zzjM0VJeWmL2AjSaSx1fLxQYBIwYyhdndei3Ayu8MkgNH6lWxDPS3j7gm/MEZDj6yfJdklalQXA0A66B+xxljFsC3wFGt5ImahJ7BN3Ujek99uQSTZdOKFZWF3Bvnn7zPJooX9ipXVw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1789489518; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qGNJ7A5rYjk14XWdBhCha6GZVKDCLU0PUZU66dD8slQ=; b=UM4I8HwdVUCd4J9epHaWY0FxhAclIyng66sNFuBbRwMGf/bXBAngKM0ucPpSR6/ebib+Usm/VgyS3C5H+VEo2uDzXzO/3+pLT0GR7zeQape2JEDxe4N9udecQXvOiqL06oCczE2avuW04mEt/qQ753u02PddqXMF+YhPCC+NorY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1789489518059574.1553621971062; Tue, 15 Sep 2026 09:25:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x6Vxh-0004Ri-6Z; Tue, 15 Sep 2026 12:24:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x6Vxc-0004RQ-Sx for qemu-devel@nongnu.org; Tue, 15 Sep 2026 12:24:45 -0400 Received: from mx.swemel.ru ([95.143.211.150]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x6Vxa-0001xX-QI for qemu-devel@nongnu.org; Tue, 15 Sep 2026 12:24:44 -0400 Message-ID: <500d4850-f7d7-45fb-91e5-74d32d35fde2@swemel.ru> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=swemel.ru; s=mail; t=1789489479; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qGNJ7A5rYjk14XWdBhCha6GZVKDCLU0PUZU66dD8slQ=; b=LHOVlhJp8PCwsRSKfFMWXvOF3N7KVorBhM471ZLOES1dJtX64XNOYcMBzKelGd9Z3SyYuL UTw6pjhmuO+T1B353HoDUfaeZX9Uto+bW9A4U2M6X6013zEr+r2z9ht2Yg1H/0pQJ/xrWe h4/5+03xLuMjeLL//yVOgzzV2EhuisQ= Date: Tue, 15 Sep 2026 19:24:39 +0300 MIME-Version: 1.0 Content-Language: en-US, ru-RU To: qemu-devel@nongnu.org Cc: jasowang@redhat.com, mst@redhat.com, armbru@redhat.com From: =?UTF-8?B?0J3QuNC60L7Qu9Cw0Lkg0JfQvtGA0LjQvQ==?= Subject: [PATCH] util/error, hw/net/virtio-net: fix NULL pointer dereference in error_vprepend Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=95.143.211.150; envelope-from=zorin@swemel.ru; helo=mx.swemel.ru X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @swemel.ru) X-ZM-MESSAGEID: 1789489523222158500 SWSA#b0709cee-9722-4603-a30c-dc857dc87961 The `error_vprepend()` function modifies the error message inside an existing Error object. However, it only validated if the `errp` pointer itself was non-NULL, missing a check for whether the underlying Error object `*errp` is `NULL`. Calling `error_reportf_err(local_error, ...)` when `local_error` is `NULL` invokes `error_vprepend(&local_error, ...)`, which subsequently crashes via a `NULL` pointer dereference during `(*errp)->msg` access. Fix `util/error.c` by adding a defensive `!*errp` check inside=20 `error_vprepend()`. Additionally, fix the invalid error reporting patterns in=20 `hw/net/virtio-net.c`: - In `vhost_user_net_save_state()` and `vhost_user_net_load_state()`, when =C2=A0 `vhdev =3D=3D NULL`, calling `error_reportf_err()` with an unalloca= ted/NULL =C2=A0 `local_error` is incorrect and unsafe. Replace it with a straightfo= rward =C2=A0 `error_report()` call. - Fix a cosmetic double-space typo in "Error loading=C2=A0 back-end state". Signed-off-by: Nikolay N Zorin --- =C2=A0hw/net/virtio-net.c | 14 +++++++------- =C2=A0util/error.c=C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 2 +- =C2=A02 files changed, 8 insertions(+), 8 deletions(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 4362e866..d505fb86 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -3406,9 +3406,9 @@ static int vhost_user_net_save_state(QEMUFile *f,=20 void *pv, size_t size, =C2=A0 =C2=A0 =C2=A0vhdev =3D virtio_net_get_vhost(vdev); =C2=A0 =C2=A0 =C2=A0if (vhdev =3D=3D NULL) { -=C2=A0 =C2=A0 =C2=A0 =C2=A0 error_reportf_err(local_error, -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 "Error getting vhost back-end of %s device %s: ", -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 vdev->name, vdev->parent_obj.canonical_path); +=C2=A0 =C2=A0 =C2=A0 =C2=A0 error_report("Error getting vhost back-end of = %s device %s: " +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0"device is not using vhost\n", +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0vdev->name, vdev->parent_obj.canonical_path); =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return -1; =C2=A0 =C2=A0 =C2=A0} @@ -3434,16 +3434,16 @@ static int vhost_user_net_load_state(QEMUFile=20 *f, void *pv, size_t size, =C2=A0 =C2=A0 =C2=A0vhdev =3D virtio_net_get_vhost(vdev); =C2=A0 =C2=A0 =C2=A0if (vhdev =3D=3D NULL) { -=C2=A0 =C2=A0 =C2=A0 =C2=A0 error_reportf_err(local_error, -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 "Error getting vhost back-end of %s device %s: ", -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 vdev->name, vdev->parent_obj.canonical_path); +=C2=A0 =C2=A0 =C2=A0 =C2=A0 error_report("Error getting vhost back-end of = %s device %s: " +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0"device is not using vhost\n", +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0vdev->name, vdev->parent_obj.canonical_path); =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return -1; =C2=A0 =C2=A0 =C2=A0} =C2=A0 =C2=A0 =C2=A0ret =3D vhost_load_backend_state(vhdev, f, &local_erro= r); =C2=A0 =C2=A0 =C2=A0if (ret < 0) { =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0error_reportf_err(local_error, -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 "Error loading=C2=A0 back-end state of %s device=20 %s: ", +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 "Error loading back-end state of %s device %s: ", =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0vdev->name, vdev->parent_obj.canonical_path); =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return ret; =C2=A0 =C2=A0 =C2=A0} diff --git a/util/error.c b/util/error.c index 673011b8..db8b5e43 100644 --- a/util/error.c +++ b/util/error.c @@ -133,7 +133,7 @@ void error_vprepend(Error *const *errp, const char=20 *fmt, va_list ap) =C2=A0{ =C2=A0 =C2=A0 =C2=A0GString *newmsg; -=C2=A0 =C2=A0 if (!errp) { +=C2=A0 =C2=A0 if (!errp || !*errp) { =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return; =C2=A0 =C2=A0 =C2=A0} --=20 2.43.0