ab7fc8ee5b
- target/i386: Introduce SapphireRapids-v3 to add missing features - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level - target/arm: Fix alignment for VLD4.32 - hw/microblaze: pass random seed to fdt - tests/qtest: npcm7xx-emc-test: Skip checking MAC - tests: mark io-command test as skipped if socat is missing - tests: unit: add NULL-pointer check - tests: test-qga: close socket on failure to connect - vdpa:block device capacity expansion online support vdpa block device update capacity. - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505) - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server - ppc/vof: Fix unaligned FDT property access - vvfat: Fix reading files with non-continuous clusters - vvfat: Fix bug in writing to middle of file - savevm: Fix load_snapshot error path crash - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma - hw/remote/message.c: Don't directly invoke DeviceClass:reset - crypto/tlscredspsk: Free username on finalize - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read() - virtio: remove virtio_tswap16s() call in vring_packed_event_read() - char-stdio: Restore blocking mode of stdout on exit - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab - smbios: sanitize type from external type before checking have_fields_bitmap - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code - KVM: use store-release to mark dirty pages as harvested - monitor/hmp: print trace as option in help for log command - tpm_crb: Avoid backend startup just before shutdown under Xen - crypto/block-luks: make range overlap check more readable - spapr: Free stdout path - target/rx: Use target_ulong for address in LI - virtio-pci: Fix the use of an uninitialized irqfd - rtl8139: Fix behaviour for old kernels. - virtio-rng: block max-bytes=0 MIME-Version: 1.0 - hw/audio/es1370: Clean up comment - vhost-user-server: do not set memory fd non-blocking - ui: reject extended clipboard message if not activated - virtio-net: Fix vhost virtqueue notifiers for RSS - hw/misc/applesmc: Fix memory leak in reset() handler Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit db7a5d9a7239db307c8c1454fab5f8a92fd486b8)
84 lines
3.8 KiB
Diff
84 lines
3.8 KiB
Diff
From f57991f3f88e281d3c9bcf7c1d1e2b15651c6262 Mon Sep 17 00:00:00 2001
|
|
From: guping <guping_yewu@cmss.chinamobile.com>
|
|
Date: Mon, 2 Sep 2024 09:29:45 +0000
|
|
Subject: [PATCH] virtio-pci: Fix the use of an uninitialized irqfd chery-pick
|
|
from a8e63ff289d137197ad7a701a587cc432872d798
|
|
|
|
The crash was reported in MAC OS and NixOS, here is the link for this bug
|
|
#2334
|
|
#2321
|
|
|
|
In this bug, they are using the virtio_input device. The guest notifier was
|
|
not supported for this device, The function virtio_pci_set_guest_notifiers()
|
|
was not called, and the vector_irqfd was not initialized.
|
|
|
|
So the fix is adding the check for vector_irqfd in virtio_pci_get_notifier()
|
|
|
|
The function virtio_pci_get_notifier() can be used in various devices.
|
|
It could also be called when VIRTIO_CONFIG_S_DRIVER_OK is not set. In this situation,
|
|
the vector_irqfd being NULL is acceptable. We can allow the device continue to boot
|
|
|
|
If the vector_irqfd still hasn't been initialized after VIRTIO_CONFIG_S_DRIVER_OK
|
|
is set, it means that the function set_guest_notifiers was not called before the
|
|
driver started. This indicates that the device is not using the notifier.
|
|
At this point, we will let the check fail.
|
|
|
|
This fix is verified in vyatta,MacOS,NixOS,fedora system.
|
|
|
|
The bt tree for this bug is:
|
|
Thread 6 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault.
|
|
[Switching to Thread 0x7c817be006c0 (LWP 1269146)]
|
|
kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
|
|
817 if (irqfd->users == 0) {
|
|
(gdb) thread apply all bt
|
|
...
|
|
Thread 6 (Thread 0x7c817be006c0 (LWP 1269146) "CPU 0/KVM"):
|
|
0 kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
|
|
1 kvm_virtio_pci_vector_use_one () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:893
|
|
2 0x00005983657045e2 in memory_region_write_accessor () at ../qemu-9.0.0/system/memory.c:497
|
|
3 0x0000598365704ba6 in access_with_adjusted_size () at ../qemu-9.0.0/system/memory.c:573
|
|
4 0x0000598365705059 in memory_region_dispatch_write () at ../qemu-9.0.0/system/memory.c:1528
|
|
5 0x00005983659b8e1f in flatview_write_continue_step.isra.0 () at ../qemu-9.0.0/system/physmem.c:2713
|
|
6 0x000059836570ba7d in flatview_write_continue () at ../qemu-9.0.0/system/physmem.c:2743
|
|
7 flatview_write () at ../qemu-9.0.0/system/physmem.c:2774
|
|
8 0x000059836570bb76 in address_space_write () at ../qemu-9.0.0/system/physmem.c:2894
|
|
9 0x0000598365763afe in address_space_rw () at ../qemu-9.0.0/system/physmem.c:2904
|
|
10 kvm_cpu_exec () at ../qemu-9.0.0/accel/kvm/kvm-all.c:2917
|
|
11 0x000059836576656e in kvm_vcpu_thread_fn () at ../qemu-9.0.0/accel/kvm/kvm-accel-ops.c:50
|
|
12 0x0000598365926ca8 in qemu_thread_start () at ../qemu-9.0.0/util/qemu-thread-posix.c:541
|
|
13 0x00007c8185bcd1cf in ??? () at /usr/lib/libc.so.6
|
|
14 0x00007c8185c4e504 in clone () at /usr/lib/libc.so.6
|
|
|
|
Fixes: 2ce6cff9
|
|
|
|
("virtio-pci: fix use of a released vector")
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Cindy Lu's avatarCindy Lu <lulu@redhat.com>
|
|
Message-Id: <20240806093715.65105-1-lulu@redhat.com>
|
|
Acked-by: Jason Wang's avatarJason Wang <jasowang@redhat.com>
|
|
Reviewed-by: MST's avatarMichael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: MST's avatarMichael S. Tsirkin <mst@redhat.com>
|
|
|
|
Signed-off-by: guping <guping_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/virtio/virtio-pci.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
|
|
index d675526016..1e4661bebd 100644
|
|
--- a/hw/virtio/virtio-pci.c
|
|
+++ b/hw/virtio/virtio-pci.c
|
|
@@ -811,6 +811,9 @@ static int virtio_pci_get_notifier(VirtIOPCIProxy *proxy, int queue_no,
|
|
VirtIODevice *vdev = virtio_bus_get_device(&proxy->bus);
|
|
VirtQueue *vq;
|
|
|
|
+ if (!proxy->vector_irqfd && vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)
|
|
+ return -1;
|
|
+
|
|
if (queue_no == VIRTIO_CONFIG_IRQ_IDX) {
|
|
*n = virtio_config_get_guest_notifier(vdev);
|
|
*vector = vdev->config_vector;
|
|
--
|
|
2.41.0.windows.1
|
|
|