Commit 1aba4be9 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging 



A smattering of fixes for problems that Coverity reported.

# gpg: Signature made Mon 17 Nov 2014 17:03:25 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  hcd-musb: fix dereference null return value
  target-cris/translate.c: fix out of bounds read
  shpc: fix error propaagation
  qemu-char: fix MISSING_COMMA
  acl: fix memory leak
  nvme: remove superfluous check
  loader: fix NEGATIVE_RETURNS
  qga: fix false negative argument passing
  mips_mipssim: fix use-after-free for filename
  l2tpv3: fix fd leak
  l2tpv3: fix possible double free
  libcacard: fix resource leak

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents d8edf52a a9be7657

hw/block/nvme.c

+1 −2
Original line number Diff line number Diff line
@@ -583,8 +583,7 @@ static int nvme_start_ctrl(NvmeCtrl *n) 
            NVME_CC_IOCQES(n->bar.cc) > NVME_CTRL_CQES_MAX(n->id_ctrl.cqes) ||

            NVME_CC_IOSQES(n->bar.cc) < NVME_CTRL_SQES_MIN(n->id_ctrl.sqes) ||

            NVME_CC_IOSQES(n->bar.cc) > NVME_CTRL_SQES_MAX(n->id_ctrl.sqes) ||

            !NVME_AQA_ASQS(n->bar.aqa) || NVME_AQA_ASQS(n->bar.aqa) > 4095 ||

            !NVME_AQA_ACQS(n->bar.aqa) || NVME_AQA_ACQS(n->bar.aqa) > 4095) {

            !NVME_AQA_ASQS(n->bar.aqa) || !NVME_AQA_ACQS(n->bar.aqa)) {

        return -1;

    }

hw/core/loader.c

+13 −0
Original line number Diff line number Diff line
@@ -80,6 +80,13 @@ int load_image(const char *filename, uint8_t *addr) 
    if (fd < 0)

        return -1;

    size = lseek(fd, 0, SEEK_END);

    if (size == -1) {

        fprintf(stderr, "file %-20s: get size error: %s\n",

                filename, strerror(errno));

        close(fd);

        return -1;

    }



    lseek(fd, 0, SEEK_SET);

    if (read(fd, addr, size) != size) {

        close(fd);
@@ -748,6 +755,12 @@ int rom_add_file(const char *file, const char *fw_dir, 
    }

    rom->addr     = addr;

    rom->romsize  = lseek(fd, 0, SEEK_END);

    if (rom->romsize == -1) {

        fprintf(stderr, "rom: file %-20s: get size error: %s\n",

                rom->name, strerror(errno));

        goto err;

    }



    rom->datasize = rom->romsize;

    rom->data     = g_malloc0(rom->datasize);

    lseek(fd, 0, SEEK_SET);

hw/mips/mips_mipssim.c

+1 −1
Original line number Diff line number Diff line
@@ -197,7 +197,7 @@ mips_mipssim_init(MachineState *machine) 
        !kernel_filename && !qtest_enabled()) {

        /* Bail out if we have neither a kernel image nor boot vector code. */

        error_report("Could not load MIPS bios '%s', and no "

                     "-kernel argument was specified", filename);

                     "-kernel argument was specified", bios_name);

        exit(1);

    } else {

        /* We have a boot vector start address. */

hw/pci/shpc.c

+2 −1
Original line number Diff line number Diff line
@@ -559,8 +559,9 @@ void shpc_device_hot_unplug_request_cb(HotplugHandler *hotplug_dev, 
    uint8_t led;

    int slot;



    shpc_device_hotplug_common(PCI_DEVICE(dev), &slot, shpc, errp);

    shpc_device_hotplug_common(PCI_DEVICE(dev), &slot, shpc, &local_err);

    if (local_err) {

        error_propagate(errp, local_err);

        return;

    }

hw/usb/hcd-musb.c

+6 −2
Original line number Diff line number Diff line
@@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, 
    USBDevice *dev;

    USBEndpoint *uep;

    int idx = epnum && dir;

    int id;

    int ttype;



    /* ep->type[0,1] contains:
@@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, 
    /* A wild guess on the FADDR semantics... */

    dev = usb_find_device(&s->port, ep->faddr[idx]);

    uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);

    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,

                     (dev->addr << 16) | (uep->nr << 8) | pid, false, true);

    id = pid;

    if (uep) {

        id |= (dev->addr << 16) | (uep->nr << 8);

    }

    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);

    usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);

    ep->packey[dir].ep = ep;

    ep->packey[dir].dir = dir;