From 2d9bdbbedf30ef0eb8cf968d6a10ebe914a82265 Mon Sep 17 00:00:00 2001 From: Miroslav Rezanina Date: Mon, 5 Jan 2026 09:23:30 +0100 Subject: [PATCH] * Mon Jan 05 2026 Miroslav Rezanina - 10.1.0-10 - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) --- ...x-BDS-use-after-free-during-shutdown.patch | 64 +++++++++++++++++++ qemu-kvm.spec | 9 ++- rpminspect.yaml | 4 +- 3 files changed, 74 insertions(+), 3 deletions(-) create mode 100644 kvm-block-Fix-BDS-use-after-free-during-shutdown.patch diff --git a/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch b/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch new file mode 100644 index 0000000..0bc5baf --- /dev/null +++ b/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch @@ -0,0 +1,64 @@ +From 8f3dbb64c2217e7c46df964311f210c6a3c9e8be Mon Sep 17 00:00:00 2001 +From: Kevin Wolf +Date: Mon, 15 Dec 2025 16:07:14 +0100 +Subject: [PATCH] block: Fix BDS use after free during shutdown + +RH-Author: Thomas Huth +RH-MergeRequest: 446: Fix crash that happens when powering-off a guest during migration +RH-Jira: RHEL-108142 +RH-Acked-by: Cornelia Huck +RH-Acked-by: Miroslav Rezanina +RH-Commit: [1/1] af2687210d89fef5c4229a84371236c2b9bbdf5b (thuth/qemu-kvm-cs) + +JIRA: https://issues.redhat.com/browse/RHEL-108142 + +During shutdown, blockdev_close_all_bdrv_states() drops any block node +references that are still owned by the monitor (i.e. the user). However, +in doing so, it forgot to also remove the node from monitor_bdrv_states +(which qmp_blockdev_del() correctly does), which means that later calls +of bdrv_first()/bdrv_next() will still return the (now stale) pointer to +the node. + +Usually there is no such call after this point, but in some cases it can +happen. In the reported case, there was an ongoing migration, and the +migration thread wasn't shut down yet: migration_shutdown() called by +qemu_cleanup() doesn't actually wait for the migration to be shut down, +but may just move it to MIGRATION_STATUS_CANCELLING. The next time +migration_iteration_finish() runs, it sees the status and tries to +re-activate all block devices that migration may have previously +inactivated. This is where bdrv_first()/bdrv_next() get called and the +access to the already freed node happens. + +It is debatable if migration_shutdown() should really return before +migration has settled, but leaving a dangling pointer in the list of +monitor-owned block nodes is clearly a bug either way and fixing it +solves the immediate problem, so fix it. + +Reported-by: Thomas Huth +Signed-off-by: Kevin Wolf +Message-ID: <20251215150714.130214-1-kwolf@redhat.com> +Reviewed-by: Thomas Huth +Tested-by: Thomas Huth +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Kevin Wolf +(cherry picked from commit 307bc43095b8ab1765fd66c26003d5da06681c05) +Signed-off-by: Thomas Huth +--- + blockdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/blockdev.c b/blockdev.c +index b451fee6e1..76c8dd0573 100644 +--- a/blockdev.c ++++ b/blockdev.c +@@ -685,6 +685,7 @@ void blockdev_close_all_bdrv_states(void) + + GLOBAL_STATE_CODE(); + QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) { ++ QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list); + bdrv_unref(bs); + } + } +-- +2.47.3 + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index 00b3732..77867a6 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 9%{?rcrel}%{?dist}%{?cc_suffix} +Release: 10%{?rcrel}%{?dist}%{?cc_suffix} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -345,6 +345,8 @@ Patch94: kvm-qemu-img-info-Optionally-show-block-limits.patch Patch95: kvm-qemu-img-info-Add-cache-mode-option.patch # For RHEL-111853 - [Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10] Patch96: kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch +# For RHEL-108142 - QEMU crashes when stopping source VM during live migration +Patch97: kvm-block-Fix-BDS-use-after-free-during-shutdown.patch %if %{have_clang} BuildRequires: clang @@ -1424,6 +1426,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Jan 05 2026 Miroslav Rezanina - 10.1.0-10 +- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] +- Resolves: RHEL-108142 + (QEMU crashes when stopping source VM during live migration) + * Mon Dec 15 2025 Miroslav Rezanina - 10.1.0-9 - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212] - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003] diff --git a/rpminspect.yaml b/rpminspect.yaml index 41cc1ea..30274b3 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,8 +4,8 @@ elf: inspections: badfuncs: off annocheck: - - hardened: --skip-cf-protection --skip-property-note --ignore-unknown --verbose - - rhel-policy: --skip-cf-protection --skip-property-note --ignore-unknown --verbose + - hardened: --skip-cf-protection --skip-property-note --skip-stack-clash --ignore-unknown --verbose + - rhel-policy: --skip-cf-protection --skip-property-note --skip-stack-clash --ignore-unknown --verbose ignore: - /usr/share/qemu-kvm/s390-ccw.img - /usr/share/qemu-kvm/s390-netboot.img