From: Prasad J Pandit
When registering a MemoryRegionOps object, assert that its
read/write callback methods are defined. This avoids potential
guest crash via a NULL pointer dereference.
Suggested-by: Peter Maydell
Reviewed-by: Li Qiang
Signed-off-by: Prasad J Pandit
---
memory.c | 10 +-
1 file changed, 9 insertions(+), 1 deletion(-)
Update v3: Add Reviewed-by: ...
-> https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09467.html
diff --git a/memory.c b/memory.c
index 9200b20130..5e22bce326 100644
--- a/memory.c
+++ b/memory.c
@@ -1485,7 +1485,13 @@ void memory_region_init_io(MemoryRegion *mr,
uint64_t size)
{
memory_region_init(mr, owner, name, size);
-mr->ops = ops ? ops : &unassigned_mem_ops;
+if (ops) {
+assert(ops->read || ops->read_with_attrs);
+assert(ops->write || ops->write_with_attrs);
+mr->ops = ops;
+} else {
+mr->ops = &unassigned_mem_ops;
+}
mr->opaque = opaque;
mr->terminates = true;
}
@@ -1663,6 +1669,8 @@ void memory_region_init_rom_device_nomigrate(MemoryRegion
*mr,
{
Error *err = NULL;
assert(ops);
+assert(ops->read || ops->read_with_attrs);
+assert(ops->write || ops->write_with_attrs);
memory_region_init(mr, owner, name, size);
mr->ops = ops;
mr->opaque = opaque;
--
2.26.2