81 lines
3.9 KiB
Diff
81 lines
3.9 KiB
Diff
|
From 9cd544b83ccd37b9dd7977717a245437533830cd Mon Sep 17 00:00:00 2001
|
||
|
|
From: Cindy Lu <lulu@redhat.com>
|
||
|
|
Date: Tue, 6 Aug 2024 17:37:12 +0800
|
||
|
|
Subject: [PATCH] virtio-pci: Fix the use of an uninitialized irqfd
|
||
|
|
|
||
|
|
The crash was reported in MAC OS and NixOS, here is the link for this bug
|
||
|
|
https://gitlab.com/qemu-project/qemu/-/issues/2334
|
||
|
|
https://gitlab.com/qemu-project/qemu/-/issues/2321
|
||
|
|
|
||
|
|
In this bug, they are using the virtio_input device. The guest notifier was
|
||
|
|
not supported for this device, The function virtio_pci_set_guest_notifiers()
|
||
|
|
was not called, and the vector_irqfd was not initialized.
|
||
|
|
|
||
|
|
So the fix is adding the check for vector_irqfd in virtio_pci_get_notifier()
|
||
|
|
|
||
|
|
The function virtio_pci_get_notifier() can be used in various devices.
|
||
|
|
It could also be called when VIRTIO_CONFIG_S_DRIVER_OK is not set. In this situation,
|
||
|
|
the vector_irqfd being NULL is acceptable. We can allow the device continue to boot
|
||
|
|
|
||
|
|
If the vector_irqfd still hasn't been initialized after VIRTIO_CONFIG_S_DRIVER_OK
|
||
|
|
is set, it means that the function set_guest_notifiers was not called before the
|
||
|
|
driver started. This indicates that the device is not using the notifier.
|
||
|
|
At this point, we will let the check fail.
|
||
|
|
|
||
|
|
This fix is verified in vyatta,MacOS,NixOS,fedora system.
|
||
|
|
|
||
|
|
The bt tree for this bug is:
|
||
|
|
Thread 6 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault.
|
||
|
|
[Switching to Thread 0x7c817be006c0 (LWP 1269146)]
|
||
|
|
kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
|
||
|
|
817 if (irqfd->users == 0) {
|
||
|
|
(gdb) thread apply all bt
|
||
|
|
...
|
||
|
|
Thread 6 (Thread 0x7c817be006c0 (LWP 1269146) "CPU 0/KVM"):
|
||
|
|
0 kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
|
||
|
|
1 kvm_virtio_pci_vector_use_one () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:893
|
||
|
|
2 0x00005983657045e2 in memory_region_write_accessor () at ../qemu-9.0.0/system/memory.c:497
|
||
|
|
3 0x0000598365704ba6 in access_with_adjusted_size () at ../qemu-9.0.0/system/memory.c:573
|
||
|
|
4 0x0000598365705059 in memory_region_dispatch_write () at ../qemu-9.0.0/system/memory.c:1528
|
||
|
|
5 0x00005983659b8e1f in flatview_write_continue_step.isra.0 () at ../qemu-9.0.0/system/physmem.c:2713
|
||
|
|
6 0x000059836570ba7d in flatview_write_continue () at ../qemu-9.0.0/system/physmem.c:2743
|
||
|
|
7 flatview_write () at ../qemu-9.0.0/system/physmem.c:2774
|
||
|
|
8 0x000059836570bb76 in address_space_write () at ../qemu-9.0.0/system/physmem.c:2894
|
||
|
|
9 0x0000598365763afe in address_space_rw () at ../qemu-9.0.0/system/physmem.c:2904
|
||
|
|
10 kvm_cpu_exec () at ../qemu-9.0.0/accel/kvm/kvm-all.c:2917
|
||
|
|
11 0x000059836576656e in kvm_vcpu_thread_fn () at ../qemu-9.0.0/accel/kvm/kvm-accel-ops.c:50
|
||
|
|
12 0x0000598365926ca8 in qemu_thread_start () at ../qemu-9.0.0/util/qemu-thread-posix.c:541
|
||
|
|
13 0x00007c8185bcd1cf in ??? () at /usr/lib/libc.so.6
|
||
|
|
14 0x00007c8185c4e504 in clone () at /usr/lib/libc.so.6
|
||
|
|
|
||
|
|
Fixes: 2ce6cff94d ("virtio-pci: fix use of a released vector")
|
||
|
|
Cc: qemu-stable@nongnu.org
|
||
|
|
Signed-off-by: Cindy Lu <lulu@redhat.com>
|
||
|
|
Message-Id: <20240806093715.65105-1-lulu@redhat.com>
|
||
|
|
Acked-by: Jason Wang <jasowang@redhat.com>
|
||
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|
|
(cherry picked from commit a8e63ff289d137197ad7a701a587cc432872d798)
|
||
|
|
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/virtio/virtio-pci.c | 3 +++
|
||
|
|
1 file changed, 3 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
|
||
|
|
index 3ad7487411..06b125ec62 100644
|
||
|
|
--- a/hw/virtio/virtio-pci.c
|
||
|
|
+++ b/hw/virtio/virtio-pci.c
|
||
|
|
@@ -860,6 +860,9 @@ static int virtio_pci_get_notifier(VirtIOPCIProxy *proxy, int queue_no,
|
||
|
|
VirtIODevice *vdev = virtio_bus_get_device(&proxy->bus);
|
||
|
|
VirtQueue *vq;
|
||
|
|
|
||
|
|
+ if (!proxy->vector_irqfd && vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)
|
||
|
|
+ return -1;
|
||
|
|
+
|
||
|
|
if (queue_no == VIRTIO_CONFIG_IRQ_IDX) {
|
||
|
|
*n = virtio_config_get_guest_notifier(vdev);
|
||
|
|
*vector = vdev->config_vector;
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|