On Mon, 27 Jul 2026 at 12:53, Marc-André Lureau
<[email protected]> wrote:
>
> From: Akihiko Odaki <[email protected]>
>
> virtio_gpu_base_device_realize() leaks a migration blocker if a
> check of the output list fails after adding one. Perform the check
> before adding a migration blocker to avoid the leak. This also
> simplifies the code by merging two loops.
>
> Fixes: d3a4969dc5ac ("Support per-head resolutions with virtio-gpu")
> Signed-off-by: Akihiko Odaki <[email protected]>
> Reviewed-by: Marc-André Lureau <[email protected]>
> Message-ID: <[email protected]>
> ---
> hw/display/virtio-gpu-base.c | 37 ++++++++++++++++---------------------
> 1 file changed, 16 insertions(+), 21 deletions(-)
> @@ -207,6 +212,17 @@ virtio_gpu_base_device_realize(DeviceState *qdev,
> node->value->name, EDID_NAME_MAX_LENGTH);
> return false;
> }
> + if (node->value->has_xres != node->value->has_yres) {
> + error_setg(errp,
> + "must set both outputs[%zd].xres and
> outputs[%zd].yres",
> + output_idx, output_idx);
> + return false;
> + }
> + if (node->value->has_xres && node->value->has_yres) {
> + g->enabled_output_bitmask |= (1 << output_idx);
> + g->req_state[output_idx].width = node->value->xres;
> + g->req_state[output_idx].height = node->value->yres;
> + }
Hi; Coverity points out an issue with this change (CID 1664272):
just before this added code there is an existing check:
if (node->value && node->value->name &&
strlen(node->value->name) > EDID_NAME_MAX_LENGTH) {
...
}
That check assumes that node->value can be NULL, but this added
code assumes node->value is not NULL and unconditionally
dereferences it. Which is correct ?
thanks
-- PMM
