From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 30 May 2013 14:14:44 +0000 (+0200)
Subject: vhost-scsi: fix k->set_guest_notifiers() NULL dereference
X-Git-Tag: v1.5.1~5
X-Git-Url: https://git.proxmox.com/?p=qemu.git;a=commitdiff_plain;h=5e690bb9748e50e0deb406e982a17c0c7b6e65cf

vhost-scsi: fix k->set_guest_notifiers() NULL dereference

Coverity picked up a copy-paste bug.  In vhost_scsi_start() we check for
!k->set_guest_notifiers and error out.  The check probably got copied
but instead of erroring we actually use the function pointer!

Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Asias He <asias@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0e22a2d18998fd183c8181663981eb681ca977e9)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index d7a1c3318..785e93f54 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -123,7 +123,7 @@ static void vhost_scsi_stop(VHostSCSI *s)
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
     int ret = 0;
 
-    if (!k->set_guest_notifiers) {
+    if (k->set_guest_notifiers) {
         ret = k->set_guest_notifiers(qbus->parent, s->dev.nvqs, false);
         if (ret < 0) {
                 error_report("vhost guest notifier cleanup failed: %d\n", ret);