From patchwork Fri Nov 23 15:56:18 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 201359 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 023232C008E for ; Sat, 24 Nov 2012 02:57:19 +1100 (EST) Received: from localhost ([::1]:33680 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Tbvcz-0006a8-7j for incoming@patchwork.ozlabs.org; Fri, 23 Nov 2012 10:57:17 -0500 Received: from eggs.gnu.org ([208.118.235.92]:52052) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TbvcJ-0004g5-SF for qemu-devel@nongnu.org; Fri, 23 Nov 2012 10:56:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TbvcI-0000nL-R2 for qemu-devel@nongnu.org; Fri, 23 Nov 2012 10:56:35 -0500 Received: from mail-ie0-f173.google.com ([209.85.223.173]:56771) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TbvcI-0000me-Mw for qemu-devel@nongnu.org; Fri, 23 Nov 2012 10:56:34 -0500 Received: by mail-ie0-f173.google.com with SMTP id e13so3265827iej.4 for ; Fri, 23 Nov 2012 07:56:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references; bh=/Rvlv3fph2sz5+f5SnqoxZe2sHSZ9EZpqc3ZakYfuhY=; b=s5DYti8DdWUZLd0Q7JJKqQYc4WTM0GBqFalDPMsCgMDRGibNNPsg3tCZ9ybMCGIg6D 7v02ScVqShmVvDkpt4kmNJzBqRqjVlwz02UjvoPeNb8JEnrPgnomoHkN4HUbhV8At42C OQnlLvTZkUWioSRgdEk7AzHWOVOVbcomRUfMT3NZR5BA0C1rUkn68xwwQ+HZXGBFtkDh hYYQ0aFSXQr+6YR2kqavT4qZHF9mz5XJvS46SRDgIO9JVGRUnj0NeIfOMbgwYdHOfY5g L/JwaxhFa+xTgqbcSDwoDKHflqE/2oS8/myyWyU71tffNKlollgv4JqxnGhT3vxiRQnz B8Ng== Received: by 10.50.15.231 with SMTP id a7mr3945989igd.11.1353686194399; Fri, 23 Nov 2012 07:56:34 -0800 (PST) Received: from yakj.usersys.redhat.com (93-34-169-1.ip50.fastwebnet.it. [93.34.169.1]) by mx.google.com with ESMTPS id vq4sm4498640igb.10.2012.11.23.07.56.31 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 23 Nov 2012 07:56:33 -0800 (PST) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Fri, 23 Nov 2012 16:56:18 +0100 Message-Id: <1353686178-27520-3-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.8.0 In-Reply-To: <1353686178-27520-1-git-send-email-pbonzini@redhat.com> References: <1353686178-27520-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 209.85.223.173 Cc: aliguori@us.ibm.com, armbru@redhat.com, lcapitulino@redhat.com Subject: [Qemu-devel] [PATCH 1.3 2/2] hmp: do not crash on invalid SCSI hotplug X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Commit 0d93692 (qdev: Convert busses to QEMU Object Model, 2012-05-02) removed a check on the type of the bus where a SCSI disk is hotplugged. However, hot-plugging to the wrong kind of device now causes a crash due to either a NULL pointer dereference (avoided by the previous patch) or a failed QOM cast. Instead, in this case we need to use object_dynamic_cast and check for the result, similar to what was done before that commit. Reported-by: Markus Armbruster Signed-off-by: Paolo Bonzini --- hw/pci-hotplug.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/pci-hotplug.c b/hw/pci-hotplug.c index e7fb780..0ca5546 100644 --- a/hw/pci-hotplug.c +++ b/hw/pci-hotplug.c @@ -80,7 +80,13 @@ static int scsi_hot_add(Monitor *mon, DeviceState *adapter, SCSIBus *scsibus; SCSIDevice *scsidev; - scsibus = SCSI_BUS(QLIST_FIRST(&adapter->child_bus)); + scsibus = (SCSIBus *) + object_dynamic_cast(OBJECT(QLIST_FIRST(&adapter->child_bus)), + TYPE_SCSI_BUS); + if (!scsibus) { + error_report("Device is not a SCSI adapter"); + return -1; + } /* * drive_init() tries to find a default for dinfo->unit. Doesn't