* Mon Jan 05 2026 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-10
- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration)
This commit is contained in:
Miroslav Rezanina
parent
fafea41eff
commit
2d9bdbbedf
64
kvm-block-Fix-BDS-use-after-free-during-shutdown.patch
Normal file
64
kvm-block-Fix-BDS-use-after-free-during-shutdown.patch
Normal file
@ -0,0 +1,64 @@
|
||||
From 8f3dbb64c2217e7c46df964311f210c6a3c9e8be Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Wolf <kwolf@redhat.com>
|
||||
Date: Mon, 15 Dec 2025 16:07:14 +0100
|
||||
Subject: [PATCH] block: Fix BDS use after free during shutdown
|
||||
|
||||
RH-Author: Thomas Huth <thuth@redhat.com>
|
||||
RH-MergeRequest: 446: Fix crash that happens when powering-off a guest during migration
|
||||
RH-Jira: RHEL-108142
|
||||
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
|
||||
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
||||
RH-Commit: [1/1] af2687210d89fef5c4229a84371236c2b9bbdf5b (thuth/qemu-kvm-cs)
|
||||
|
||||
JIRA: https://issues.redhat.com/browse/RHEL-108142
|
||||
|
||||
During shutdown, blockdev_close_all_bdrv_states() drops any block node
|
||||
references that are still owned by the monitor (i.e. the user). However,
|
||||
in doing so, it forgot to also remove the node from monitor_bdrv_states
|
||||
(which qmp_blockdev_del() correctly does), which means that later calls
|
||||
of bdrv_first()/bdrv_next() will still return the (now stale) pointer to
|
||||
the node.
|
||||
|
||||
Usually there is no such call after this point, but in some cases it can
|
||||
happen. In the reported case, there was an ongoing migration, and the
|
||||
migration thread wasn't shut down yet: migration_shutdown() called by
|
||||
qemu_cleanup() doesn't actually wait for the migration to be shut down,
|
||||
but may just move it to MIGRATION_STATUS_CANCELLING. The next time
|
||||
migration_iteration_finish() runs, it sees the status and tries to
|
||||
re-activate all block devices that migration may have previously
|
||||
inactivated. This is where bdrv_first()/bdrv_next() get called and the
|
||||
access to the already freed node happens.
|
||||
|
||||
It is debatable if migration_shutdown() should really return before
|
||||
migration has settled, but leaving a dangling pointer in the list of
|
||||
monitor-owned block nodes is clearly a bug either way and fixing it
|
||||
solves the immediate problem, so fix it.
|
||||
|
||||
Reported-by: Thomas Huth <thuth@redhat.com>
|
||||
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
||||
Message-ID: <20251215150714.130214-1-kwolf@redhat.com>
|
||||
Reviewed-by: Thomas Huth <thuth@redhat.com>
|
||||
Tested-by: Thomas Huth <thuth@redhat.com>
|
||||
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
||||
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
||||
(cherry picked from commit 307bc43095b8ab1765fd66c26003d5da06681c05)
|
||||
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
||||
---
|
||||
blockdev.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/blockdev.c b/blockdev.c
|
||||
index b451fee6e1..76c8dd0573 100644
|
||||
--- a/blockdev.c
|
||||
+++ b/blockdev.c
|
||||
@@ -685,6 +685,7 @@ void blockdev_close_all_bdrv_states(void)
|
||||
|
||||
GLOBAL_STATE_CODE();
|
||||
QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) {
|
||||
+ QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
|
||||
bdrv_unref(bs);
|
||||
}
|
||||
}
|
||||
--
|
||||
2.47.3
|
||||
|
||||
@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \
|
||||
Summary: QEMU is a machine emulator and virtualizer
|
||||
Name: qemu-kvm
|
||||
Version: 10.1.0
|
||||
Release: 9%{?rcrel}%{?dist}%{?cc_suffix}
|
||||
Release: 10%{?rcrel}%{?dist}%{?cc_suffix}
|
||||
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
|
||||
# Epoch 15 used for RHEL 8
|
||||
# Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
|
||||
@ -345,6 +345,8 @@ Patch94: kvm-qemu-img-info-Optionally-show-block-limits.patch
|
||||
Patch95: kvm-qemu-img-info-Add-cache-mode-option.patch
|
||||
# For RHEL-111853 - [Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]
|
||||
Patch96: kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch
|
||||
# For RHEL-108142 - QEMU crashes when stopping source VM during live migration
|
||||
Patch97: kvm-block-Fix-BDS-use-after-free-during-shutdown.patch
|
||||
|
||||
%if %{have_clang}
|
||||
BuildRequires: clang
|
||||
@ -1424,6 +1426,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Jan 05 2026 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-10
|
||||
- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142]
|
||||
- Resolves: RHEL-108142
|
||||
(QEMU crashes when stopping source VM during live migration)
|
||||
|
||||
* Mon Dec 15 2025 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-9
|
||||
- kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212]
|
||||
- kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003]
|
||||
|
||||
@ -4,8 +4,8 @@ elf:
|
||||
inspections:
|
||||
badfuncs: off
|
||||
annocheck:
|
||||
- hardened: --skip-cf-protection --skip-property-note --ignore-unknown --verbose
|
||||
- rhel-policy: --skip-cf-protection --skip-property-note --ignore-unknown --verbose
|
||||
- hardened: --skip-cf-protection --skip-property-note --skip-stack-clash --ignore-unknown --verbose
|
||||
- rhel-policy: --skip-cf-protection --skip-property-note --skip-stack-clash --ignore-unknown --verbose
|
||||
ignore:
|
||||
- /usr/share/qemu-kvm/s390-ccw.img
|
||||
- /usr/share/qemu-kvm/s390-netboot.img
|
||||
|
||||
Loading…
Reference in New Issue
Block a user