From 2255f6b7966d981054397765a700e8a34c6a15c4 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Tue, 30 Jun 2020 11:03:48 +0200 Subject: [PATCH] aspeed: Fix realize error API violation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. aspeed_soc_ast2600_realize() and aspeed_soc_realize() are wrong that way: they pass &err to object_property_set_int() and object_property_set_bool() without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: "Cédric Le Goater" Cc: Peter Maydell Cc: Andrew Jeffery Cc: Joel Stanley Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster Message-Id: <20200630090351.1247703-24-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé --- hw/arm/aspeed_ast2600.c | 5 +++-- hw/arm/aspeed_soc.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c index 4efac02e2b..59a7a1370b 100644 --- a/hw/arm/aspeed_ast2600.c +++ b/hw/arm/aspeed_ast2600.c @@ -383,7 +383,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) for (i = 0; i < sc->spis_num; i++) { object_property_set_link(OBJECT(&s->spi[i]), OBJECT(s->dram_mr), "dram", &error_abort); - object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err); + object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", + &error_abort); sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &err); if (err) { error_propagate(errp, err); @@ -434,7 +435,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) /* Net */ for (i = 0; i < sc->macs_num; i++) { object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed", - &err); + &error_abort); sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), &err); if (err) { error_propagate(errp, err); diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c index 03b91bade6..311458aa76 100644 --- a/hw/arm/aspeed_soc.c +++ b/hw/arm/aspeed_soc.c @@ -333,7 +333,8 @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp) /* SPI */ for (i = 0; i < sc->spis_num; i++) { - object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err); + object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", + &error_abort); sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &err); if (err) { error_propagate(errp, err); @@ -384,7 +385,7 @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp) /* Net */ for (i = 0; i < sc->macs_num; i++) { object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed", - &err); + &error_abort); sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), &err); if (err) { error_propagate(errp, err);