From 740a19313b85527f6984b0fd4fee9b683b4ea1e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 13 Jun 2019 23:34:06 +0200 Subject: [PATCH] spapr_pci: Fix potential NULL pointer dereference in spapr_dt_pci_bus() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 14e714900f6 refactored the call to spapr_dt_drc(), introducing a potential NULL pointer dereference while accessing bus->parent_dev. A trivial audit show 'bus' is not null in the two places the static function spapr_dt_drc() is called. Since the 'bus' parameter is not NULL in both callers, remove remove the test on if (bus), and add an assert() to silent static analyzers. This fixes: /hw/ppc/spapr_pci.c: 1367 in spapr_dt_pci_bus() >>> CID 1401933: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "bus". 1367 ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev), 1368 SPAPR_DR_CONNECTOR_TYPE_PCI); Fixes: 14e714900f6 Reported-by: Coverity (CID 1401933) Suggested-by: Greg Kurz Suggested-by: David Gibson Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20190613213406.22053-1-philmd@redhat.com> Signed-off-by: David Gibson --- hw/ppc/spapr_pci.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c index 957ae88bbd..fbeb1c90ee 100644 --- a/hw/ppc/spapr_pci.c +++ b/hw/ppc/spapr_pci.c @@ -1356,12 +1356,11 @@ static int spapr_dt_pci_bus(SpaprPhbState *sphb, PCIBus *bus, _FDT(fdt_setprop_cell(fdt, offset, "#size-cells", RESOURCE_CELLS_SIZE)); - if (bus) { - pci_for_each_device_reverse(bus, pci_bus_num(bus), - spapr_dt_pci_device_cb, &cbinfo); - if (cbinfo.err) { - return cbinfo.err; - } + assert(bus); + pci_for_each_device_reverse(bus, pci_bus_num(bus), + spapr_dt_pci_device_cb, &cbinfo); + if (cbinfo.err) { + return cbinfo.err; } ret = spapr_dt_drc(fdt, offset, OBJECT(bus->parent_dev),