From 7b17ef78eee2b30829666f12e87ff1eee3c195b5 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Tue, 15 Aug 2023 19:00:44 -0400 Subject: [PATCH] vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present RH-Author: Jon Maloy RH-MergeRequest: 304: vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present RH-Bugzilla: 2215786 RH-Acked-by: Ani Sinha RH-Acked-by: Miroslav Rezanina RH-Commit: [1/1] 16aa37efdf129f2619cedf9c030222b88eda9e26 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2) Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2215786 CVE: CVE-2023-3301 Upstream: Merged Conflicts: commit babf8b87127a is not present in this release, so the commit does not apply cleanly. The two adjacent munmap() calls introduced by that commit don't seem to be needed for the logics of this change. commit a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 Author: Ani Sinha Date: Mon Jun 19 12:22:09 2023 +0530 vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present When a peer nic is still attached to the vdpa backend, it is too early to free up the vhost-net and vdpa structures. If these structures are freed here, then QEMU crashes when the guest is being shut down. The following call chain would result in an assertion failure since the pointer returned from vhost_vdpa_get_vhost_net() would be NULL: do_vm_stop() -> vm_state_notify() -> virtio_set_status() -> virtio_net_vhost_status() -> get_vhost_net(). Therefore, we defer freeing up the structures until at guest shutdown time when qemu_cleanup() calls net_cleanup() which then calls qemu_del_net_client() which would eventually call vhost_vdpa_cleanup() again to free up the structures. This time, the loop in net_cleanup() ensures that vhost_vdpa_cleanup() will be called one last time when all the peer nics are detached and freed. All unit tests pass with this change. CC: imammedo@redhat.com CC: jusual@redhat.com CC: mst@redhat.com Fixes: CVE-2023-3301 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929 Signed-off-by: Ani Sinha Message-Id: <20230619065209.442185-1-anisinha@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Signed-off-by: Jon Maloy --- net/vhost-vdpa.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c index 814f704687..ac48de9495 100644 --- a/net/vhost-vdpa.c +++ b/net/vhost-vdpa.c @@ -128,6 +128,14 @@ static void vhost_vdpa_cleanup(NetClientState *nc) { VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc); + /* + * If a peer NIC is attached, do not cleanup anything. + * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup() + * when the guest is shutting down. + */ + if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) { + return; + } if (s->vhost_net) { vhost_net_cleanup(s->vhost_net); g_free(s->vhost_net); -- 2.39.3