rpms/qemu-kvm
8
0
Fork 0
Code Issues Pull Requests Releases Activity

* Mon Jan 19 2026 Jon Maloy <jmaloy@redhat.com> - 10.1.0-11

Browse Source 
- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240]
- Resolves: RHEL-138240
  (QEMU crashes when stopping source VM during live migration [rhel-9])
This commit is contained in:
Jon Maloy 2026-01-19 15:36:33 -05:00
parent e1f43d5ebc
commit c60e175901
2 changed files with 73 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
kvm-block-Fix-BDS-use-after-free-during-shutdown.patch Normal file
View File

@ -0,0 +1,65 @@
From 53e5b063f6c23b804e3539ca66a0a2f428a97cd1 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 15 Dec 2025 16:07:14 +0100
Subject: [PATCH] block: Fix BDS use after free during shutdown
RH-Author: Thomas Huth <thuth@redhat.com>
RH-MergeRequest: 452: Fix crash that happens when powering-off a guest during migration [cs9]
RH-Jira: RHEL-138240
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
RH-Commit: [1/1] c0ab4eb9fbfade013bde4e88549c0f0290160061 (thuth/qemu-kvm-cs)
JIRA: https://issues.redhat.com/browse/RHEL-138240
During shutdown, blockdev_close_all_bdrv_states() drops any block node
references that are still owned by the monitor (i.e. the user). However,
in doing so, it forgot to also remove the node from monitor_bdrv_states
(which qmp_blockdev_del() correctly does), which means that later calls
of bdrv_first()/bdrv_next() will still return the (now stale) pointer to
the node.
Usually there is no such call after this point, but in some cases it can
happen. In the reported case, there was an ongoing migration, and the
migration thread wasn't shut down yet: migration_shutdown() called by
qemu_cleanup() doesn't actually wait for the migration to be shut down,
but may just move it to MIGRATION_STATUS_CANCELLING. The next time
migration_iteration_finish() runs, it sees the status and tries to
re-activate all block devices that migration may have previously
inactivated. This is where bdrv_first()/bdrv_next() get called and the
access to the already freed node happens.
It is debatable if migration_shutdown() should really return before
migration has settled, but leaving a dangling pointer in the list of
monitor-owned block nodes is clearly a bug either way and fixing it
solves the immediate problem, so fix it.
Cc: qemu-stable@nongnu.org
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251215150714.130214-1-kwolf@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 307bc43095b8ab1765fd66c26003d5da06681c05)
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
blockdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/blockdev.c b/blockdev.c
index b451fee6e1..76c8dd0573 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -685,6 +685,7 @@ void blockdev_close_all_bdrv_states(void)
GLOBAL_STATE_CODE();
QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) {
+ QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
bdrv_unref(bs);
}
}
--
2.52.0

9
qemu-kvm.spec
View File

@ -149,7 +149,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \
Summary: QEMU is a machine emulator and virtualizer
Name: qemu-kvm
Version: 10.1.0
Release: 10%{?rcrel}%{?dist}%{?cc_suffix}
Release: 11%{?rcrel}%{?dist}%{?cc_suffix}
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
# Epoch 15 used for RHEL 8
# Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -294,6 +294,8 @@ Patch74: kvm-accel-mshv-initialize-thread-name.patch
Patch75: kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch
# For RHEL-132193 - [rhel 9.8]L1VH qemu downstream initial merge RHEL9
Patch76: kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch
# For RHEL-138240 - QEMU crashes when stopping source VM during live migration [rhel-9]
Patch77: kvm-block-Fix-BDS-use-after-free-during-shutdown.patch
# For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
@ -2008,6 +2010,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
%endif
%changelog
* Mon Jan 19 2026 Jon Maloy <jmaloy@redhat.com> - 10.1.0-11
- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240]
- Resolves: RHEL-138240
(QEMU crashes when stopping source VM during live migration [rhel-9])
* Mon Dec 15 2025 Jon Maloy <jmaloy@redhat.com> - 10.1.0-10
- kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193]
- Resolves: RHEL-132193