@samitouri / QOSamiQemu / commits / 7913b3b946

hw/core/qdev-clock: Fix potential null pointer dereference

qdev_get_clocklist() function returns a pointer to the NamedClockList struct. This function is called in qdev_alias_clock() and the returned pointer is immediately dereferenced without a null check. Passing a clock name that doesn't exist to qdev_get_clocklist() is a programming error, and so this change is not fixing a bug, only making the reporting of that programming error a bit more helpful and bringing it in to line with qdev_get_clock_in() and qdev_get_clock_out(). Cc: luc@lmichel.fr Cc: peter.maydell@linaro.org Cc: hemanshu_dev@proton.me Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2342 Signed-off-by: hemanshu.khilari.foss <hemanshu.khilari.foss@gmail.com> Message-id: 20260531153354.88909-2-hemanshu.khilari.foss@gmail.com Reviewed-by: Luc Michel <luc@lmichel.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hemanshu.khilari.foss committed May 31, 2026 at 21:03 UTC 7913b3b9463ffb4078d33c7ddaeacd1bb38aae3e

1 file changed +8 -1

hw/core/qdev-clock.c

+8 -1

@@ -157,7 +157,14 @@ Clock *qdev_alias_clock(DeviceState *dev, const char *name,

157 DeviceState *alias_dev, const char *alias_name)

158 {

159 NamedClockList *ncl = qdev_get_clocklist(dev, name);

160 - Clock *clk = ncl->clock;

160 + Clock *clk;

161 +

162 + if (!ncl) {

163 + error_report("Can not find clock '%s' for device type '%s'",

164 + name, object_get_typename(OBJECT(dev)));

165 + abort();

166 + }

167 + clk = ncl->clock;

168

169 ncl = qdev_init_clocklist(alias_dev, alias_name, true, ncl->output, clk);

170