@samitouri / QOSamiQemu / commits / 5322889f07

rutabaga: improve error handling, fix potential crash during init

When virtio_gpu_rutabaga_get_num_capsets() returns 0, virtio_init() isn't called and the device later crashes during realize. ==72545==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x556ad6f7ba9e bp 0x7ffe6958f810 sp 0x7ffe6958f7e0 T0) ==72545==The signal is caused by a READ memory access. ==72545==Hint: address points to the zero page. #0 0x556ad6f7ba9e in virtio_memory_listener_commit ../hw/virtio/virtio.c:4034 #1 0x556ad6a24c96 in listener_add_address_space ../system/memory.c:3128 #2 0x556ad6a25d15 in memory_listener_register ../system/memory.c:3216 #3 0x556ad6f7bf11 in virtio_device_realize ../hw/virtio/virtio.c:4075 Rework error handling of the function to set Error appropriately. 0 capset may be ok now. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Marc-André Lureau committed Jan 27, 2026 at 16:09 UTC 5322889f07b5cba09df9500a788daa42a977cc94

1 file changed +9 -10

hw/display/virtio-gpu-rutabaga.c

+9 -10

@@ -1032,19 +1032,19 @@ static bool virtio_gpu_rutabaga_init(VirtIOGPU *g, Error **errp)

1032 return true;

1033 }

1034

1035 -static int virtio_gpu_rutabaga_get_num_capsets(VirtIOGPU *g)

1035 +static bool

1036 +virtio_gpu_rutabaga_get_num_capsets(VirtIOGPU *g, uint32_t *num_capsets, Error **errp)

1037 {

1038 int result;

1038 - uint32_t num_capsets;

1039 VirtIOGPURutabaga *vr = VIRTIO_GPU_RUTABAGA(g);

1040

1041 - result = rutabaga_get_num_capsets(vr->rutabaga, &num_capsets);

1041 + result = rutabaga_get_num_capsets(vr->rutabaga, num_capsets);

1042 if (result) {

1043 - error_report("Failed to get capsets");

1044 - return 0;

1043 + error_setg_errno(errp, -result, "Failed to get num_capsets");

1044 + return false;

1045 }

1046 - vr->num_capsets = num_capsets;

1047 - return num_capsets;

1046 + vr->num_capsets = *num_capsets;

1047 + return true;

1048 }

1049

1050 static void virtio_gpu_rutabaga_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)

@@ -1070,7 +1070,7 @@ static void virtio_gpu_rutabaga_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)

1070

1071 static void virtio_gpu_rutabaga_realize(DeviceState *qdev, Error **errp)

1072 {

1073 - int num_capsets;

1073 + uint32_t num_capsets;

1074 VirtIOGPUBase *bdev = VIRTIO_GPU_BASE(qdev);

1075 VirtIOGPU *gpudev = VIRTIO_GPU(qdev);

1076

@@ -1083,8 +1083,7 @@ static void virtio_gpu_rutabaga_realize(DeviceState *qdev, Error **errp)

1083 return;

1084 }

1085

1086 - num_capsets = virtio_gpu_rutabaga_get_num_capsets(gpudev);

1087 - if (!num_capsets) {

1086 + if (!virtio_gpu_rutabaga_get_num_capsets(gpudev, &num_capsets, errp)) {

1087 return;

1088 }

1089