[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 05/53] balloon: fix segfault and harden the stats que
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 05/53] balloon: fix segfault and harden the stats queue |
Date: |
Fri, 11 Mar 2016 17:07:42 +0200 |
From: Ladi Prosek <address@hidden>
The segfault here is triggered by the driver notifying the stats queue
twice after adding a buffer to it. This effectively resets stats_vq_elem
back to NULL and QEMU crashes on the next stats timer tick in
balloon_stats_poll_cb.
This is a regression introduced in 51b19ebe4320f3dc, although admittedly
the device assumed too much about the stats queue protocol even before
that commit. This commit adds a few more checks and ensures that the one
stats buffer gets deallocated on device reset.
Cc: address@hidden
Signed-off-by: Ladi Prosek <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/virtio/virtio-balloon.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index e9c30e9..e97d403 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -101,7 +101,7 @@ static void balloon_stats_poll_cb(void *opaque)
VirtIOBalloon *s = opaque;
VirtIODevice *vdev = VIRTIO_DEVICE(s);
- if (!balloon_stats_supported(s)) {
+ if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
/* re-schedule */
balloon_stats_change_timer(s, s->stats_poll_interval);
return;
@@ -258,11 +258,20 @@ static void virtio_balloon_receive_stats(VirtIODevice
*vdev, VirtQueue *vq)
size_t offset = 0;
qemu_timeval tv;
- s->stats_vq_elem = elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
+ elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
if (!elem) {
goto out;
}
+ if (s->stats_vq_elem != NULL) {
+ /* This should never happen if the driver follows the spec. */
+ virtqueue_push(vq, s->stats_vq_elem, 0);
+ virtio_notify(vdev, vq);
+ g_free(s->stats_vq_elem);
+ }
+
+ s->stats_vq_elem = elem;
+
/* Initialize the stats to get rid of any stale values. This is only
* needed to handle the case where a guest supports fewer stats than it
* used to (ie. it has booted into an old kernel).
@@ -458,6 +467,16 @@ static void virtio_balloon_device_unrealize(DeviceState
*dev, Error **errp)
virtio_cleanup(vdev);
}
+static void virtio_balloon_device_reset(VirtIODevice *vdev)
+{
+ VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
+
+ if (s->stats_vq_elem != NULL) {
+ g_free(s->stats_vq_elem);
+ s->stats_vq_elem = NULL;
+ }
+}
+
static void virtio_balloon_instance_init(Object *obj)
{
VirtIOBalloon *s = VIRTIO_BALLOON(obj);
@@ -486,6 +505,7 @@ static void virtio_balloon_class_init(ObjectClass *klass,
void *data)
set_bit(DEVICE_CATEGORY_MISC, dc->categories);
vdc->realize = virtio_balloon_device_realize;
vdc->unrealize = virtio_balloon_device_unrealize;
+ vdc->reset = virtio_balloon_device_reset;
vdc->get_config = virtio_balloon_get_config;
vdc->set_config = virtio_balloon_set_config;
vdc->get_features = virtio_balloon_get_features;
--
MST
- [Qemu-devel] [PULL 00/53] vhost, virtio, pci, pc, acpi, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 01/53] acpi: add aml_create_field(), Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 02/53] acpi: add aml_concatenate(), Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 03/53] acpi: allow using object as offset for OperationRegion, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 04/53] acpi: add build_append_named_dword, returning an offset in buffer, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 06/53] hw/virtio: fix double use of a virtio flag, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 07/53] hw/virtio: group virtio flags into an enum, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 05/53] balloon: fix segfault and harden the stats queue,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 08/53] virtio-balloon: add 'available' counter, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 11/53] i386/acpi: make floppy controller object dynamic, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 10/53] pc-dimm: fix error handling in pc_dimm_check_memdev_is_busy(), Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 09/53] vhost-user: verify that number of queues is less than MAX_QUEUE_NUM, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 12/53] i386: expose floppy drive CMOS type, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 14/53] i386: populate floppy drive information in DSDT, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 13/53] fdc: add function to determine drive chs limits, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 15/53] i386: update expected DSDT, Michael S. Tsirkin, 2016/03/11
- [Qemu-devel] [PULL 16/53] virtio-pci: call pci reset variant when guest requests reset., Michael S. Tsirkin, 2016/03/11