vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
When vfio_device_get_region_info() fails in vfio_pci_load_rom(), the function returns without setting vdev->rom_read_failed to true, and without allocating vdev->rom. This leaves vdev->rom as NULL. Signed-off-by: Mario Casquero <mcasquer@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260602070857.356526-1-mcasquer@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Mario Casquero committed
Jun 2, 2026 at 09:08 UTC
c822ecd806614fa24e7d3bd120a0f96b00d6d1a5
1 file changed
+6
-5
hw/vfio/pci.c
+6
-5
@@ -1028,7 +1028,7 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
1028
}
1029
}
1030
1031
-static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
1031
+static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
1032
{
1033
VFIODevice *vbasedev = &vdev->vbasedev;
1034
struct vfio_region_info *reg_info = NULL;
@@ -1042,7 +1042,7 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
1042
1043
if (ret != 0) {
1044
error_report("vfio: Error getting ROM info: %s", strerror(-ret));
1045
- return;
1045
+ return false;
1046
}
1047
1048
trace_vfio_pci_load_rom(vbasedev->name, (unsigned long)reg_info->size,
@@ -1053,12 +1053,11 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
1053
vdev->rom_offset = reg_info->offset;
1054
1055
if (!vdev->rom_size) {
1056
- vdev->rom_read_failed = true;
1056
error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
1057
error_printf("Device option ROM contents are probably invalid "
1058
"(check dmesg).\nSkip option ROM probe with rombar=0, "
1059
"or load from file with romfile=\n");
1061
- return;
1060
+ return false;
1061
}
1062
1063
vdev->rom = g_malloc(size);
@@ -1114,6 +1113,8 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
1113
data[6] = -csum;
1114
}
1115
}
1116
+
1117
+ return true;
1118
}
1119
1120
/* "Raw" read of underlying config space. */
@@ -1147,7 +1148,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
1148
1149
/* Load the ROM lazily when the guest tries to read it */
1150
if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
1150
- vfio_pci_load_rom(vdev);
1151
+ vdev->rom_read_failed = !vfio_pci_load_rom(vdev);
1152
}
1153
1154
memcpy(&val, vdev->rom + addr,