qemu/hw
Kevin Wolf a9d52a7563 block/qdev: Fix NULL access when using BB twice
BlockBackend has only a single pointer to its guest device, so it makes
sure that only a single guest device is attached to it. device-add
returns an error if you try to attach a second device to a BB. In order
to make the error message nicer, -device that manually connects to a
if=none block device get a different message than -drive that implicitly
creates a guest device. The if=... option is stored in DriveInfo.

However, since blockdev-add exists, not every BlockBackend has a
DriveInfo any more. Check that it exists before we dereference it.

QMP reproducer resulting in a segfault:

{"execute":"blockdev-add","arguments":{"options":{"id":"disk","driver":"file","filename":"/tmp/test.img"}}}
{"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}}
{"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}}

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-07-05 16:46:26 +02:00
..
9pfs 9p: synth: drop v9fs_ prefix 2016-07-01 14:38:54 +02:00
acpi
alpha
arm ast2400: create SPI flash slaves 2016-07-04 13:15:22 +01:00
audio pcspk: fix KVM 2016-06-30 19:00:02 +01:00
block block: Switch transfer length bounds to byte-based 2016-07-05 16:46:25 +02:00
bt
char * serial port fixes (Paolo) 2016-06-29 19:14:48 +01:00
core block/qdev: Fix NULL access when using BB twice 2016-07-05 16:46:26 +02:00
cpu
cris
display ssi: change ssi_slave_init to be a realize ops 2016-07-04 13:15:22 +01:00
dma dma: Add Xilinx Zynq devcfg device model 2016-07-04 13:15:22 +01:00
gpio
i2c ICH9 SMB: make TYPE_ICH9_SMB_DEVICE macro public 2016-06-29 14:03:46 +02:00
i386 intel_iommu: Throw hw_error on notify_started 2016-06-30 13:00:24 -06:00
ide * serial port fixes (Paolo) 2016-06-29 19:14:48 +01:00
input pckbd: handle A20 IRQ as GPIO 2016-06-29 14:03:46 +02:00
intc armv7m_nvic: Use qemu_get_cpu(0) instead of current_cpu 2016-07-04 13:15:22 +01:00
ipack
ipmi
isa ich9: implement SCI_IRQ_SEL register 2016-06-29 14:03:48 +02:00
lm32
m68k
mem
microblaze m25p80: qdev-ify drive property 2016-07-04 13:15:22 +01:00
mips
misc ssi: change ssi_slave_init to be a realize ops 2016-07-04 13:15:22 +01:00
moxie
net ipxe: update submodule from 4e03af8ec to 041863191 2016-07-05 12:46:18 +01:00
nvram
openrisc
pci
pci-bridge
pci-host Q35: implement property interfece to several parameters 2016-06-29 14:03:46 +02:00
pcmcia
ppc ppc/hash64: Add proper real mode translation support 2016-07-05 14:31:08 +10:00
s390x
scsi block: Switch transfer length bounds to byte-based 2016-07-05 16:46:25 +02:00
sd ssi: change ssi_slave_init to be a realize ops 2016-07-04 13:15:22 +01:00
sh4 hw/sh4/sh_pci.c: Use ldl_le_p() and stl_le_p() 2016-06-28 15:09:32 +01:00
smbios
sparc
sparc64
ssi ast2400: add SPI flash slaves 2016-07-04 13:15:22 +01:00
timer MC146818 RTC: add GPIO access to output IRQ 2016-06-29 14:03:46 +02:00
tpm
tricore
unicore32
usb
vfio vfio/spapr: Create DMA window dynamically (SPAPR IOMMU v2) 2016-07-05 14:31:08 +10:00
virtio virtio-bus: remove old set_host_notifier callback 2016-06-24 08:47:35 +03:00
watchdog
xen
xenpv
xtensa
Makefile.objs