fd7488b82b
- kvm-vhost-vdpa-do-not-cleanup-the-vdpa-vhost-net-structu.patch [bz#2215786] - Resolves: bz#2215786 (CVE-2023-3301 virt:rhel/qemu-kvm: QEMU: net: triggerable assertion due to race condition in hot-unplug [rhel-8])
82 lines
3.2 KiB
Diff
82 lines
3.2 KiB
Diff
From 7b17ef78eee2b30829666f12e87ff1eee3c195b5 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Tue, 15 Aug 2023 19:00:44 -0400
|
|
Subject: [PATCH] vhost-vdpa: do not cleanup the vdpa/vhost-net structures if
|
|
peer nic is present
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 304: vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
|
|
RH-Bugzilla: 2215786
|
|
RH-Acked-by: Ani Sinha <None>
|
|
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
RH-Commit: [1/1] 16aa37efdf129f2619cedf9c030222b88eda9e26 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
|
|
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2215786
|
|
CVE: CVE-2023-3301
|
|
Upstream: Merged
|
|
Conflicts: commit babf8b87127a is not present in this release, so the commit does not
|
|
apply cleanly. The two adjacent munmap() calls introduced by that commit
|
|
don't seem to be needed for the logics of this change.
|
|
|
|
commit a0d7215e339b61c7d7a7b3fcf754954d80d93eb8
|
|
Author: Ani Sinha <anisinha@redhat.com>
|
|
Date: Mon Jun 19 12:22:09 2023 +0530
|
|
|
|
vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
|
|
|
|
When a peer nic is still attached to the vdpa backend, it is too early to free
|
|
up the vhost-net and vdpa structures. If these structures are freed here, then
|
|
QEMU crashes when the guest is being shut down. The following call chain
|
|
would result in an assertion failure since the pointer returned from
|
|
vhost_vdpa_get_vhost_net() would be NULL:
|
|
|
|
do_vm_stop() -> vm_state_notify() -> virtio_set_status() ->
|
|
virtio_net_vhost_status() -> get_vhost_net().
|
|
|
|
Therefore, we defer freeing up the structures until at guest shutdown
|
|
time when qemu_cleanup() calls net_cleanup() which then calls
|
|
qemu_del_net_client() which would eventually call vhost_vdpa_cleanup()
|
|
again to free up the structures. This time, the loop in net_cleanup()
|
|
ensures that vhost_vdpa_cleanup() will be called one last time when
|
|
all the peer nics are detached and freed.
|
|
|
|
All unit tests pass with this change.
|
|
|
|
CC: imammedo@redhat.com
|
|
CC: jusual@redhat.com
|
|
CC: mst@redhat.com
|
|
Fixes: CVE-2023-3301
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929
|
|
Signed-off-by: Ani Sinha <anisinha@redhat.com>
|
|
Message-Id: <20230619065209.442185-1-anisinha@redhat.com>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
net/vhost-vdpa.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
|
|
index 814f704687..ac48de9495 100644
|
|
--- a/net/vhost-vdpa.c
|
|
+++ b/net/vhost-vdpa.c
|
|
@@ -128,6 +128,14 @@ static void vhost_vdpa_cleanup(NetClientState *nc)
|
|
{
|
|
VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
|
|
|
|
+ /*
|
|
+ * If a peer NIC is attached, do not cleanup anything.
|
|
+ * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup()
|
|
+ * when the guest is shutting down.
|
|
+ */
|
|
+ if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
|
|
+ return;
|
|
+ }
|
|
if (s->vhost_net) {
|
|
vhost_net_cleanup(s->vhost_net);
|
|
g_free(s->vhost_net);
|
|
--
|
|
2.39.3
|
|
|