| Message ID | 20200324134947.15384-2-peter.maydell@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | hw/arm/xlnx-zynqmp.c: fix some error-handling code | expand |
On 3/24/20 2:49 PM, Peter Maydell wrote: > In xlnx_zynqmp_realize() if the attempt to realize the SD > controller object fails then the error-return path will leak > the 'bus_name' string. Fix this by deferring the allocation > until after the realize has succeeded. > > Fixes: Coverity CID 1421911 > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > hw/arm/xlnx-zynqmp.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c > index 49f1c8d0de2..a13dbeeacec 100644 > --- a/hw/arm/xlnx-zynqmp.c > +++ b/hw/arm/xlnx-zynqmp.c > @@ -520,7 +520,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) > sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]); > > for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) { > - char *bus_name = g_strdup_printf("sd-bus%d", i); > + char *bus_name; > SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]); > Object *sdhci = OBJECT(&s->sdhci[i]); > > @@ -541,6 +541,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) > sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]); > > /* Alias controller SD bus to the SoC itself */ > + bus_name = g_strdup_printf("sd-bus%d", i); > object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus", > &error_abort); > g_free(bus_name); > Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
On Tue, Mar 24, 2020 at 6:50 AM Peter Maydell <peter.maydell@linaro.org> wrote: > > In xlnx_zynqmp_realize() if the attempt to realize the SD > controller object fails then the error-return path will leak > the 'bus_name' string. Fix this by deferring the allocation > until after the realize has succeeded. > > Fixes: Coverity CID 1421911 > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Alistair > --- > hw/arm/xlnx-zynqmp.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c > index 49f1c8d0de2..a13dbeeacec 100644 > --- a/hw/arm/xlnx-zynqmp.c > +++ b/hw/arm/xlnx-zynqmp.c > @@ -520,7 +520,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) > sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]); > > for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) { > - char *bus_name = g_strdup_printf("sd-bus%d", i); > + char *bus_name; > SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]); > Object *sdhci = OBJECT(&s->sdhci[i]); > > @@ -541,6 +541,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) > sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]); > > /* Alias controller SD bus to the SoC itself */ > + bus_name = g_strdup_printf("sd-bus%d", i); > object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus", > &error_abort); > g_free(bus_name); > -- > 2.20.1 > >
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c index 49f1c8d0de2..a13dbeeacec 100644 --- a/hw/arm/xlnx-zynqmp.c +++ b/hw/arm/xlnx-zynqmp.c @@ -520,7 +520,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]); for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) { - char *bus_name = g_strdup_printf("sd-bus%d", i); + char *bus_name; SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]); Object *sdhci = OBJECT(&s->sdhci[i]); @@ -541,6 +541,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]); /* Alias controller SD bus to the SoC itself */ + bus_name = g_strdup_printf("sd-bus%d", i); object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus", &error_abort); g_free(bus_name);
In xlnx_zynqmp_realize() if the attempt to realize the SD controller object fails then the error-return path will leak the 'bus_name' string. Fix this by deferring the allocation until after the realize has succeeded. Fixes: Coverity CID 1421911 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/xlnx-zynqmp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)