From 505bc9b025ca9ad5f1d8b1886a3fe816afcc53b1 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Tue, 15 Nov 2016 19:25:39 +0100 Subject: [PATCH] qemu: Fix improper union member access on hostdevs Add missing checks if a hostdev is a subsystem/SCSI device before access the union member 'subsys'/'scsi'. Also fix indentation and simplify qemuDomainObjCheckHostdevTaint(). Signed-off-by: Marc Hartmayer Reviewed-by: Bjoern Walk Reviewed-by: Boris Fiuczynski --- src/qemu/qemu_domain.c | 10 +++++----- src/qemu/qemu_process.c | 4 ++++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 6de9ea57c1..06c25adbe6 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4037,12 +4037,12 @@ void qemuDomainObjCheckHostdevTaint(virQEMUDriverPtr driver, virDomainHostdevDefPtr hostdev, qemuDomainLogContextPtr logCtxt) { - virDomainHostdevSubsysSCSIPtr scsisrc = &hostdev->source.subsys.u.scsi; + if (!(hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && + hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI)) + return; - if (hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && - scsisrc->rawio == VIR_TRISTATE_BOOL_YES) - qemuDomainObjTaint(driver, obj, VIR_DOMAIN_TAINT_HIGH_PRIVILEGES, - logCtxt); + if (hostdev->source.subsys.u.scsi.rawio == VIR_TRISTATE_BOOL_YES) + qemuDomainObjTaint(driver, obj, VIR_DOMAIN_TAINT_HIGH_PRIVILEGES, logCtxt); } diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 3552a3130e..cca6754c4a 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4312,6 +4312,10 @@ qemuProcessSetupRawIO(virQEMUDriverPtr driver, /* If rawio not already set, check hostdevs as well */ if (!rawio) { for (i = 0; i < vm->def->nhostdevs; i++) { + if (!(vm->def->hostdevs[i]->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && + vm->def->hostdevs[i]->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI)) + continue; + virDomainHostdevSubsysSCSIPtr scsisrc = &vm->def->hostdevs[i]->source.subsys.u.scsi; if (scsisrc->rawio == VIR_TRISTATE_BOOL_YES) {