s390x-cpu property setters set_feature() and set_feature_group() dereference @errp when the visitor fails. That's wrong; see the big comment in error.h. Introduced in commit 0754f60429 "s390x/cpumodel: expose features and feature groups as properties".
No caller actually passes null. Fix anyway: splice in a local Error *err, and error_propagate(). Cc: David Hildenbrand <da...@redhat.com> Cc: Cornelia Huck <coh...@redhat.com> Signed-off-by: Markus Armbruster <arm...@redhat.com> Reviewed-by: David Hildenbrand <da...@redhat.com> --- target/s390x/cpu_models.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 7e92fb2e15..6a29fd3ab1 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -987,6 +987,7 @@ static void get_feature(Object *obj, Visitor *v, const char *name, static void set_feature(Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { + Error *err = NULL; S390Feat feat = (S390Feat) opaque; DeviceState *dev = DEVICE(obj); S390CPU *cpu = S390_CPU(obj); @@ -1002,8 +1003,9 @@ static void set_feature(Object *obj, Visitor *v, const char *name, return; } - visit_type_bool(v, name, &value, errp); - if (*errp) { + visit_type_bool(v, name, &value, &err); + if (err) { + error_propagate(errp, err); return; } if (value) { @@ -1043,6 +1045,7 @@ static void get_feature_group(Object *obj, Visitor *v, const char *name, static void set_feature_group(Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { + Error *err = NULL; S390FeatGroup group = (S390FeatGroup) opaque; const S390FeatGroupDef *def = s390_feat_group_def(group); DeviceState *dev = DEVICE(obj); @@ -1059,8 +1062,9 @@ static void set_feature_group(Object *obj, Visitor *v, const char *name, return; } - visit_type_bool(v, name, &value, errp); - if (*errp) { + visit_type_bool(v, name, &value, &err); + if (err) { + error_propagate(errp, err); return; } if (value) { -- 2.21.0