From c60e1759013435c67d2147da36052e9cccf76cc7 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Mon, 19 Jan 2026 15:36:33 -0500 Subject: [PATCH] * Mon Jan 19 2026 Jon Maloy - 10.1.0-11 - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240] - Resolves: RHEL-138240 (QEMU crashes when stopping source VM during live migration [rhel-9]) --- ...x-BDS-use-after-free-during-shutdown.patch | 65 +++++++++++++++++++ qemu-kvm.spec | 9 ++- 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 kvm-block-Fix-BDS-use-after-free-during-shutdown.patch diff --git a/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch b/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch new file mode 100644 index 0000000..f16c93d --- /dev/null +++ b/kvm-block-Fix-BDS-use-after-free-during-shutdown.patch @@ -0,0 +1,65 @@ +From 53e5b063f6c23b804e3539ca66a0a2f428a97cd1 Mon Sep 17 00:00:00 2001 +From: Kevin Wolf +Date: Mon, 15 Dec 2025 16:07:14 +0100 +Subject: [PATCH] block: Fix BDS use after free during shutdown + +RH-Author: Thomas Huth +RH-MergeRequest: 452: Fix crash that happens when powering-off a guest during migration [cs9] +RH-Jira: RHEL-138240 +RH-Acked-by: Kevin Wolf +RH-Acked-by: Cornelia Huck +RH-Commit: [1/1] c0ab4eb9fbfade013bde4e88549c0f0290160061 (thuth/qemu-kvm-cs) + +JIRA: https://issues.redhat.com/browse/RHEL-138240 + +During shutdown, blockdev_close_all_bdrv_states() drops any block node +references that are still owned by the monitor (i.e. the user). However, +in doing so, it forgot to also remove the node from monitor_bdrv_states +(which qmp_blockdev_del() correctly does), which means that later calls +of bdrv_first()/bdrv_next() will still return the (now stale) pointer to +the node. + +Usually there is no such call after this point, but in some cases it can +happen. In the reported case, there was an ongoing migration, and the +migration thread wasn't shut down yet: migration_shutdown() called by +qemu_cleanup() doesn't actually wait for the migration to be shut down, +but may just move it to MIGRATION_STATUS_CANCELLING. The next time +migration_iteration_finish() runs, it sees the status and tries to +re-activate all block devices that migration may have previously +inactivated. This is where bdrv_first()/bdrv_next() get called and the +access to the already freed node happens. + +It is debatable if migration_shutdown() should really return before +migration has settled, but leaving a dangling pointer in the list of +monitor-owned block nodes is clearly a bug either way and fixing it +solves the immediate problem, so fix it. + +Cc: qemu-stable@nongnu.org +Reported-by: Thomas Huth +Signed-off-by: Kevin Wolf +Message-ID: <20251215150714.130214-1-kwolf@redhat.com> +Reviewed-by: Thomas Huth +Tested-by: Thomas Huth +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Kevin Wolf +(cherry picked from commit 307bc43095b8ab1765fd66c26003d5da06681c05) +Signed-off-by: Thomas Huth +--- + blockdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/blockdev.c b/blockdev.c +index b451fee6e1..76c8dd0573 100644 +--- a/blockdev.c ++++ b/blockdev.c +@@ -685,6 +685,7 @@ void blockdev_close_all_bdrv_states(void) + + GLOBAL_STATE_CODE(); + QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) { ++ QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list); + bdrv_unref(bs); + } + } +-- +2.52.0 + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index 5d9fa3b..a4eb948 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -149,7 +149,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 10%{?rcrel}%{?dist}%{?cc_suffix} +Release: 11%{?rcrel}%{?dist}%{?cc_suffix} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -294,6 +294,8 @@ Patch74: kvm-accel-mshv-initialize-thread-name.patch Patch75: kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch # For RHEL-132193 - [rhel 9.8]L1VH qemu downstream initial merge RHEL9 Patch76: kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch +# For RHEL-138240 - QEMU crashes when stopping source VM during live migration [rhel-9] +Patch77: kvm-block-Fix-BDS-use-after-free-during-shutdown.patch # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part @@ -2008,6 +2010,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Jan 19 2026 Jon Maloy - 10.1.0-11 +- kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240] +- Resolves: RHEL-138240 + (QEMU crashes when stopping source VM during live migration [rhel-9]) + * Mon Dec 15 2025 Jon Maloy - 10.1.0-10 - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193] - Resolves: RHEL-132193