| Message ID | 20200324121216.23899-1-peter.maydell@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [for-5.0] hw/ppc/e500.c: Handle qemu_find_file() failure | expand |
On 3/24/20 1:12 PM, Peter Maydell wrote: > If qemu_find_file() doesn't find the BIOS it returns NULL; we were > passing that unchecked through to load_elf(), which assumes a non-NULL > pointer and may misbehave. In practice it fails with a weird message: > > $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch > Bad address > qemu-system-ppc: could not load firmware '(null)' > > Handle the failure case better: > > $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch > qemu-system-ppc: could not find firmware/kernel file 'nonesuch' > > Spotted by Coverity (CID 1238954). > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > hw/ppc/e500.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c > index 854cd3ac465..0d1f41197cf 100644 > --- a/hw/ppc/e500.c > +++ b/hw/ppc/e500.c > @@ -1047,6 +1047,10 @@ void ppce500_init(MachineState *machine) > } > > filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, payload_name); > + if (!filename) { > + error_report("could not find firmware/kernel file '%s'", payload_name); > + exit(1); > + } > > payload_size = load_elf(filename, NULL, NULL, NULL, > &bios_entry, &loadaddr, NULL, NULL, > Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
On Tue, Mar 24, 2020 at 12:12:16PM +0000, Peter Maydell wrote: > If qemu_find_file() doesn't find the BIOS it returns NULL; we were > passing that unchecked through to load_elf(), which assumes a non-NULL > pointer and may misbehave. In practice it fails with a weird message: > > $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch > Bad address > qemu-system-ppc: could not load firmware '(null)' > > Handle the failure case better: > > $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch > qemu-system-ppc: could not find firmware/kernel file 'nonesuch' > > Spotted by Coverity (CID 1238954). > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Applied to ppc-for-5.0, thanks. > --- > hw/ppc/e500.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c > index 854cd3ac465..0d1f41197cf 100644 > --- a/hw/ppc/e500.c > +++ b/hw/ppc/e500.c > @@ -1047,6 +1047,10 @@ void ppce500_init(MachineState *machine) > } > > filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, payload_name); > + if (!filename) { > + error_report("could not find firmware/kernel file '%s'", payload_name); > + exit(1); > + } > > payload_size = load_elf(filename, NULL, NULL, NULL, > &bios_entry, &loadaddr, NULL, NULL, -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c index 854cd3ac465..0d1f41197cf 100644 --- a/hw/ppc/e500.c +++ b/hw/ppc/e500.c @@ -1047,6 +1047,10 @@ void ppce500_init(MachineState *machine) } filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, payload_name); + if (!filename) { + error_report("could not find firmware/kernel file '%s'", payload_name); + exit(1); + } payload_size = load_elf(filename, NULL, NULL, NULL, &bios_entry, &loadaddr, NULL, NULL,
If qemu_find_file() doesn't find the BIOS it returns NULL; we were passing that unchecked through to load_elf(), which assumes a non-NULL pointer and may misbehave. In practice it fails with a weird message: $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch Bad address qemu-system-ppc: could not load firmware '(null)' Handle the failure case better: $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch qemu-system-ppc: could not find firmware/kernel file 'nonesuch' Spotted by Coverity (CID 1238954). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/ppc/e500.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.20.1