On Mon, Oct 05, 2026 at 02:33:00 +0300, Elizaveta Tereshkina wrote: > qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value > to model_info if QEMU returns a GenericError. Passing NULL to > qemuConnectStealCPUModelFromInfo() can lead to the NULL > pointer dereference. Check the result before stealing the CPU > model to avoid this. > > Fixes: aa797c6625 (qemu_driver: expand cpu features after baseline) > Signed-off-by: Elizaveta Tereshkina <[email protected]> > --- > src/qemu/qemu_driver.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c > index ebf19d7c0f..5922065897 100644 > --- a/src/qemu/qemu_driver.c > +++ b/src/qemu/qemu_driver.c > @@ -12382,7 +12382,7 @@ qemuConnectCPUModelBaseline(virQEMUCaps *qemuCaps, > false, false, &result) < 0) > return NULL; > > - if (qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) > + if (result && qemuConnectStealCPUModelFromInfo(baseline, &result) < > 0) > return NULL; > } >
I was thinking about handling the situation in a better way, such as by reporting an error. But I think this is OK, at this point we already successfully called query-cpu-model-baseline so query-cpu-model-expansion should be implemented as well. They either both exist or none of them. Reviewed-by: Jiri Denemark <[email protected]> and pushed, thanks.
