On 9/16/26 7:16 PM, Matthew Rosato wrote:
On 9/16/26 4:32 PM, Eric Farman wrote:
The loop to store pending IRQs uses g_try_realloc() to expand the
buffer being used, but the returned address is stored in a
pointer-to-pointer. Thus, the check needs to examine its contents
and not the pointer itself.
Cc: [email protected]
Fixes: 3a553fc658 ("s390x/kvm: implement floating-interrupt controller device")
Signed-off-by: Eric Farman <[email protected]>
---
hw/intc/s390_flic_kvm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
index 5e6d422fba..ce9c720512 100644
--- a/hw/intc/s390_flic_kvm.c
+++ b/hw/intc/s390_flic_kvm.c
@@ -264,7 +264,7 @@ static int __get_all_irqs(KVMS390FLICState *flic,
}
len *= 2;
*buf = g_try_realloc(*buf, len);
Aren't we also leaking the old *buf if this fails?
Argh, yeah of course, the caller is the one doing the malloc/free, so we
don't want to silently nuke that on error. Will fix.
I think you need a local void *foo here to catch the return..
- if (!buf) {
+ if (!*buf) {
return -ENOMEM;
}
And then here a *buf = foo; to only overwrite *buf in the success case.
} while (r == -ENOMEM && len <= KVM_S390_FLIC_MAX_BUFFER);
