Re: [PATCH] target/i386: fix NULL pointer dereference in legacy-cache=off handling

On Wed Mar 11, 2026 at 3:51 PM +05, Michael Tokarev wrote:
> On 05.03.2026 09:04, Sergei Heifetz wrote:
>> The check that xcc->model is not NULL occurs after it is dereferenced
>> inside x86_cpu_get_versioned_cache_info(), so something like
>> `-cpu host,legacy-cache=off` leads to a segfault rather than an error.
>> This patch fixes that.
>> 
>> Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info")
>> Signed-off-by: Sergei Heifetz <[email protected]>
>> ---
>>   target/i386/cpu.c | 5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>> 
>> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
>> index 01b64940b1..00645e1149 100644
>> --- a/target/i386/cpu.c
>> +++ b/target/i386/cpu.c
>> @@ -10023,8 +10023,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>   
>>       /* Cache information initialization */
>>       if (!cpu->legacy_cache) {
>> -        const CPUCaches *cache_info =
>> -            x86_cpu_get_versioned_cache_info(cpu, xcc->model);
>> +        const CPUCaches *cache_info = xcc->model
>> +            ? x86_cpu_get_versioned_cache_info(cpu, xcc->model)
>> +            : NULL;
>>   
>>           if (!xcc->model || !cache_info) {
>>               g_autofree char *name = x86_cpu_class_get_model_name(xcc);
>
> With this cache_info init, the condition in the next line can be
> simplified to just (!cache_info). 

Sure.

> Dunno if it's worth the effort though.  I can fold this change into the
> patch at apply time if you're ok with it.

I'm fine with that if it's easier for you that way. Thank you.