On Thu, Jul 30, 2026 at 12:02 PM Peter Maydell <[email protected]> wrote: > > On Thu, 30 Jul 2026 at 16:36, Stefan Hajnoczi <[email protected]> wrote: > > > > virtio_add_queue()'s queue_size argument is a signed int. Coverity is > > unhappy when that type is used as an argument to g_new0(): > > > > *** CID 1664271: Error handling issues (NEGATIVE_RETURNS) > > /builds/qemu-project/qemu/hw/virtio/virtio.c: 2595 in > > virtio_add_queue() > > 2589 } > > 2590 > > 2591 vdev->vq[i].vring.num = queue_size; > > 2592 vdev->vq[i].vring.num_default = queue_size; > > 2593 vdev->vq[i].vring.align = VIRTIO_PCI_VRING_ALIGN; > > 2594 vdev->vq[i].handle_output = handle_output; > > >>> CID 1664271: Error handling issues (NEGATIVE_RETURNS) > > >>> "__n" is passed to a parameter that cannot be negative. > > 2595 vdev->vq[i].used_elems = g_new0(VirtQueueElement, > > queue_size); > > Though note that the reason Coverity thinks this value can be negative > is not because the function might be passed a negative value, but > because it incorrectly thinks that > int override = object_property_get_int(OBJECT(qbus->parent), > VIRTIO_QUEUE_SIZE_OVERRIDE, > &error_abort); > > can return a negative number. (It can't because of the error_abort > and because the property is a UINT16 one.) > > It might be a good idea to enforce the VIRTQUEUE_MAX_SIZE bounds > check on the queue size we get from the override property. Since > I think that can be set by the end-user (though probably it won't > be in practice) ideally we would not abort() on a bad property > value, but that's awkward to do at this point...
I'll send a v2 that addresses VIRTIO_QUEUE_SIZE_OVERRIDE. Stefan
