a05903a904
- kvm-spapr-xive-Mask-the-EAS-when-allocating-an-IRQ.patch [bz#1748725] - kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch [bz#1746267] - kvm-virtio-blk-Cancel-the-pending-BH-when-the-dataplane-.patch [bz#1717321] - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749737] - Resolves: bz#1717321 (qemu-kvm core dumped when repeat "system_reset" multiple times during guest boot) - Resolves: bz#1746267 (qemu coredump: qemu-kvm: block/create.c:68: qmp_blockdev_create: Assertion `drv' failed) - Resolves: bz#1748725 ([ppc][migration][v6.3-rc1-p1ce8930]basic migration failed with "qemu-kvm: KVM_SET_DEVICE_ATTR failed: Group 3 attr 0x0000000000001309: Device or resource busy") - Resolves: bz#1749737 (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-av-8])
93 lines
4.4 KiB
Diff
93 lines
4.4 KiB
Diff
From df7d91dda24b27c89ff8ce1b9cc72c7ed7350be2 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
|
|
Date: Fri, 13 Sep 2019 14:16:25 +0100
|
|
Subject: [PATCH 3/4] virtio-blk: Cancel the pending BH when the dataplane is
|
|
reset
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Message-id: <20190913141625.12521-2-philmd@redhat.com>
|
|
Patchwork-id: 90453
|
|
O-Subject: [RHEL-7.7.z qemu-kvm-rhev + RHEL-8.1.0 qemu-kvm + RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/1] virtio-blk: Cancel the pending BH when the dataplane is reset
|
|
Bugzilla: 1717321
|
|
RH-Acked-by: John Snow <jsnow@redhat.com>
|
|
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
|
|
|
|
When 'system_reset' is called, the main loop clear the memory
|
|
region cache before the BH has a chance to execute. Later when
|
|
the deferred function is called, some assumptions that were
|
|
made when scheduling them are no longer true when they actually
|
|
execute.
|
|
|
|
This is what happens using a virtio-blk device (fresh RHEL7.8 install):
|
|
|
|
$ (sleep 12.3; echo system_reset; sleep 12.3; echo system_reset; sleep 1; echo q) \
|
|
| qemu-system-x86_64 -m 4G -smp 8 -boot menu=on \
|
|
-device virtio-blk-pci,id=image1,drive=drive_image1 \
|
|
-drive file=/var/lib/libvirt/images/rhel78.qcow2,if=none,id=drive_image1,format=qcow2,cache=none \
|
|
-device virtio-net-pci,netdev=net0,id=nic0,mac=52:54:00:c4:e7:84 \
|
|
-netdev tap,id=net0,script=/bin/true,downscript=/bin/true,vhost=on \
|
|
-monitor stdio -serial null -nographic
|
|
(qemu) system_reset
|
|
(qemu) system_reset
|
|
(qemu) qemu-system-x86_64: hw/virtio/virtio.c:225: vring_get_region_caches: Assertion `caches != NULL' failed.
|
|
Aborted
|
|
|
|
(gdb) bt
|
|
Thread 1 (Thread 0x7f109c17b680 (LWP 10939)):
|
|
#0 0x00005604083296d1 in vring_get_region_caches (vq=0x56040a24bdd0) at hw/virtio/virtio.c:227
|
|
#1 0x000056040832972b in vring_avail_flags (vq=0x56040a24bdd0) at hw/virtio/virtio.c:235
|
|
#2 0x000056040832d13d in virtio_should_notify (vdev=0x56040a240630, vq=0x56040a24bdd0) at hw/virtio/virtio.c:1648
|
|
#3 0x000056040832d1f8 in virtio_notify_irqfd (vdev=0x56040a240630, vq=0x56040a24bdd0) at hw/virtio/virtio.c:1662
|
|
#4 0x00005604082d213d in notify_guest_bh (opaque=0x56040a243ec0) at hw/block/dataplane/virtio-blk.c:75
|
|
#5 0x000056040883dc35 in aio_bh_call (bh=0x56040a243f10) at util/async.c:90
|
|
#6 0x000056040883dccd in aio_bh_poll (ctx=0x560409161980) at util/async.c:118
|
|
#7 0x0000560408842af7 in aio_dispatch (ctx=0x560409161980) at util/aio-posix.c:460
|
|
#8 0x000056040883e068 in aio_ctx_dispatch (source=0x560409161980, callback=0x0, user_data=0x0) at util/async.c:261
|
|
#9 0x00007f10a8fca06d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
|
|
#10 0x0000560408841445 in glib_pollfds_poll () at util/main-loop.c:215
|
|
#11 0x00005604088414bf in os_host_main_loop_wait (timeout=0) at util/main-loop.c:238
|
|
#12 0x00005604088415c4 in main_loop_wait (nonblocking=0) at util/main-loop.c:514
|
|
#13 0x0000560408416b1e in main_loop () at vl.c:1923
|
|
#14 0x000056040841e0e8 in main (argc=20, argv=0x7ffc2c3f9c58, envp=0x7ffc2c3f9d00) at vl.c:4578
|
|
|
|
Fix this by cancelling the BH when the virtio dataplane is stopped.
|
|
|
|
[This is version of the patch was modified as discussed with Philippe on
|
|
the mailing list thread.
|
|
--Stefan]
|
|
|
|
Reported-by: Yihuang Yu <yihyu@redhat.com>
|
|
Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Fixes: https://bugs.launchpad.net/qemu/+bug/1839428
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Message-Id: <20190816171503.24761-1-philmd@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit ebb6ff25cd888a52a64a9adc3692541c6d1d9a42)
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
---
|
|
hw/block/dataplane/virtio-blk.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
|
|
index 158c78f..5fea76d 100644
|
|
--- a/hw/block/dataplane/virtio-blk.c
|
|
+++ b/hw/block/dataplane/virtio-blk.c
|
|
@@ -297,6 +297,9 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
|
|
virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
|
|
}
|
|
|
|
+ qemu_bh_cancel(s->bh);
|
|
+ notify_guest_bh(s); /* final chance to notify guest */
|
|
+
|
|
/* Clean up guest notifier (irq) */
|
|
k->set_guest_notifiers(qbus->parent, nvqs, false);
|
|
|
|
--
|
|
1.8.3.1
|
|
|