On 9/16/26 4:32 PM, Eric Farman wrote:
> The loop to store pending IRQs uses g_try_realloc() to expand the
> buffer being used, but the returned address is stored in a
> pointer-to-pointer. Thus, the check needs to examine its contents
> and not the pointer itself.
>
> Cc: [email protected]
> Fixes: 3a553fc658 ("s390x/kvm: implement floating-interrupt controller
> device")
> Signed-off-by: Eric Farman <[email protected]>
> ---
> hw/intc/s390_flic_kvm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
> index 5e6d422fba..ce9c720512 100644
> --- a/hw/intc/s390_flic_kvm.c
> +++ b/hw/intc/s390_flic_kvm.c
> @@ -264,7 +264,7 @@ static int __get_all_irqs(KVMS390FLICState *flic,
> }
> len *= 2;
> *buf = g_try_realloc(*buf, len);
Aren't we also leaking the old *buf if this fails?
I think you need a local void *foo here to catch the return..
> - if (!buf) {
> + if (!*buf) {
> return -ENOMEM;
> }
And then here a *buf = foo; to only overwrite *buf in the success case.
> } while (r == -ENOMEM && len <= KVM_S390_FLIC_MAX_BUFFER);
