Dmitry Frolov <fro...@swemel.ru> writes: > qemu_ram_block_from_host() may return NULL, which will be dereferenced w/o > check. Usualy return value is checked for this function. > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: c7c0e72408df5e7821c0e995122fb2fe0ac001f1 ("migration/ram: Handle RAM > block resizes during precopy") > Signed-off-by: Dmitry Frolov <fro...@swemel.ru> > --- > migration/ram.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/migration/ram.c b/migration/ram.c > index e4bfd39f08..bd4b7574e1 100644 > --- a/migration/ram.c > +++ b/migration/ram.c > @@ -4281,6 +4281,11 @@ static void ram_mig_ram_block_resized(RAMBlockNotifier > *n, void *host, > RAMBlock *rb = qemu_ram_block_from_host(host, false, &offset); > Error *err = NULL; > > + if (!rb) { > + error_report("RAM block not found"); > + return; > + } > + > if (migrate_ram_is_ignored(rb)) { > return; > }
Reviewed-by: Fabiano Rosas <faro...@suse.de>