Re: [GIT PULL 11/23] hw/display/virtio-gpu: Avoid leaking migration blocker

On Mon, 27 Jul 2026 at 12:53, Marc-André Lureau
<[email protected]> wrote:
>
> From: Akihiko Odaki <[email protected]>
>
> virtio_gpu_base_device_realize() leaks a migration blocker if a
> check of the output list fails after adding one. Perform the check
> before adding a migration blocker to avoid the leak. This also
> simplifies the code by merging two loops.
>
> Fixes: d3a4969dc5ac ("Support per-head resolutions with virtio-gpu")
> Signed-off-by: Akihiko Odaki <[email protected]>
> Reviewed-by: Marc-André Lureau <[email protected]>
> Message-ID: <[email protected]>
> ---
>  hw/display/virtio-gpu-base.c | 37 ++++++++++++++++---------------------
>  1 file changed, 16 insertions(+), 21 deletions(-)



> @@ -207,6 +212,17 @@ virtio_gpu_base_device_realize(DeviceState *qdev,
>                         node->value->name, EDID_NAME_MAX_LENGTH);
>              return false;
>          }
> +        if (node->value->has_xres != node->value->has_yres) {
> +            error_setg(errp,
> +                       "must set both outputs[%zd].xres and outputs[%zd].yres",
> +                       output_idx, output_idx);
> +            return false;
> +        }
> +        if (node->value->has_xres && node->value->has_yres) {
> +            g->enabled_output_bitmask |= (1 << output_idx);
> +            g->req_state[output_idx].width = node->value->xres;
> +            g->req_state[output_idx].height = node->value->yres;
> +        }

Hi; Coverity points out an issue with this change (CID 1664272):
just before this added code there is an existing check:

        if (node->value && node->value->name &&
            strlen(node->value->name) > EDID_NAME_MAX_LENGTH) {
            ...
        }

That check assumes that node->value can be NULL, but this added
code assumes node->value is not NULL and unconditionally
dereferences it. Which is correct ?

thanks
-- PMM