Re: [Qemu-devel] [PATCH] Fix crash with illegal "-net nic, model=xxx" option

[Michael S. Tsirkin]

On Thu, Apr 09, 2015 at 03:32:45PM +0200, Thomas Huth wrote:
> Current QEMU crashes when specifying an illegal model with the
> "-net nic,model=xxx" option, e.g.:
> 
>  $ qemu-system-x86_64 -net nic,model=n/a
>  qemu-system-x86_64: Unsupported NIC model: n/a
> 
>  Program received signal SIGSEGV, Segmentation fault.
> 
> The gdb backtrace looks like this:
> 
> 0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
> 152       return err->msg;
> (gdb) bt
>  0  0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152
>  1  0x0000555555965ffd in error_report_err (err=0x0) at util/error.c:157
>  2  0x0000555555809c90 in pci_nic_init_nofail (nd=0x555555e49860 <nd_table>, 
> rootbus=0x5555564409b0,
>     default_model=0x55555598c37b "e1000", default_devaddr=0x0) at 
> hw/pci/pci.c:1663
>  3  0x0000555555691e42 in pc_nic_init (isa_bus=0x555556f71900, 
> pci_bus=0x5555564409b0)
>     at hw/i386/pc.c:1506
>  4  0x000055555569396b in pc_init1 (machine=0x5555562abbf0, pci_enabled=1, 
> kvmclock_enabled=1)
>     at hw/i386/pc_piix.c:248
>  5  0x0000555555693d27 in pc_init_pci (machine=0x5555562abbf0) at 
> hw/i386/pc_piix.c:310
>  6  0x000055555572ddf5 in main (argc=3, argv=0x7fffffffe018, 
> envp=0x7fffffffe038) at vl.c:4226
> 
> The problem is that pci_nic_init_nofail() does not check whether the err
> parameter from pci_nic_init has been set up and thus passes a NULL pointer
> to error_report_err(). Fix it by correctly checking the err parameter.
> 
> Signed-off-by: Thomas Huth <address@hidden>

Reviewed-by: Michael S. Tsirkin <address@hidden>

> ---
>  hw/pci/pci.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci/pci.c b/hw/pci/pci.c
> index 6941a82..b3d5100 100644
> --- a/hw/pci/pci.c
> +++ b/hw/pci/pci.c
> @@ -1660,7 +1660,9 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus 
> *rootbus,
>  
>      res = pci_nic_init(nd, rootbus, default_model, default_devaddr, &err);
>      if (!res) {
> -        error_report_err(err);
> +        if (err) {
> +            error_report_err(err);
> +        }
>          exit(1);
>      }
>      return res;
> -- 
> 1.8.3.1