All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Michael S. Tsirkin" <mst@redhat.com>
To: qemu-devel@nongnu.org
Cc: Peter Maydell <peter.maydell@linaro.org>,
	GuoHan Zhao <zhaoguohan@kylinos.cn>,
	Paolo Bonzini <pbonzini@redhat.com>,
	Li Zhaoxin <lizhaoxin04@baidu.com>,
	Daniil Tatianin <d-tatianin@yandex-team.ru>,
	Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Subject: [PULL 25/30] hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
Date: Sun, 26 Jul 2026 17:30:00 -0400	[thread overview]
Message-ID: <2fac08ccceeeb57132584af6e06aae5dfdff87fa.1785101237.git.mst@redhat.com> (raw)
In-Reply-To: <cover.1785101237.git.mst@redhat.com>

From: GuoHan Zhao <zhaoguohan@kylinos.cn>

vhost_vdpa_device_set_config() receives the updated config buffer, but
forwards s->config to the vhost backend. Since s->config is refreshed by
get_config(), it may contain stale backend state.

Pass the supplied config buffer to vhost_dev_set_config() instead.

Fixes: b430a2bd2303 ("vdpa: add vdpa-dev support")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260709073225.2341642-1-zhaoguohan@kylinos.cn>
---
 hw/virtio/vdpa-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index 089a77f4d0..6dc684ab09 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -212,7 +212,7 @@ vhost_vdpa_device_set_config(VirtIODevice *vdev, const uint8_t *config)
     VhostVdpaDevice *s = VHOST_VDPA_DEVICE(vdev);
     int ret;
 
-    ret = vhost_dev_set_config(&s->dev, s->config, 0, s->config_size,
+    ret = vhost_dev_set_config(&s->dev, config, 0, s->config_size,
                                VHOST_SET_CONFIG_TYPE_FRONTEND);
     if (ret) {
         error_report("set device config space failed");
-- 
MST



  parent reply	other threads:[~2026-07-26 21:31 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-26 21:28 [PULL 00/30] pci, vhost, virtio, iommu: bugfixes Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 01/30] virtio: use masked features with set_features_ex Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 02/30] virtio-net: fix OOB read in RSC receive path Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 03/30] virtio-net: fix short frame OOB read in receive_filter() Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 04/30] libvhost-user: protect against OOB writes in vu_set_inflight_fd Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 05/30] libvhost-user: protect against OOB vring queue access Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 06/30] hw/virtio: reject zero-length packed indirect descriptor table Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 07/30] vhost: do not crash on ring map failure Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 08/30] virtio-scsi: fix SCSIRequest leak on a bad request Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 09/30] virtio-mmio: fix QUEUE_NUM_MAX Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 10/30] virtio: fix queue size validation against allocated maximum Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 11/30] virtio: stop migrating num_default, validate vring.num on load Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 12/30] virtio: fail early on bad config_len in migration Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 13/30] vhost-user: assert nregions within limit Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 14/30] virtio-pmem: wait for flush requests on unrealize Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 15/30] libvhost-user: validate last_batch_head in vu_check_queue_inflights Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 16/30] libvhost-user: fix heap overflow " Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 17/30] vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64 Michael S. Tsirkin
2026-07-27  0:31   ` Peter Xu
2026-07-27  8:53     ` Michael S. Tsirkin
2026-07-27 12:49       ` Peter Xu
2026-07-27 13:17         ` Michael S. Tsirkin
2026-07-27 14:12           ` Peter Xu
2026-07-27 19:06         ` Michael S. Tsirkin
2026-07-27 20:29           ` Peter Xu
2026-07-27 20:49             ` Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 18/30] libvduse: validate vq size Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 19/30] virtio-iommu: fix OOM due to unbounded call_rcu Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 20/30] virtio-snd: check rx buffer descriptor size Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 21/30] virtio-snd: check for overflow before g_malloc0 Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 22/30] hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 23/30] hw/pci-host/q35.c: Factor out creation of SMRAM MRs Michael S. Tsirkin
2026-07-26 21:29 ` [PULL 24/30] hw/pci-host/q35.c: Avoid early return in mch_write_config() Michael S. Tsirkin
2026-07-26 21:30 ` Michael S. Tsirkin [this message]
2026-07-26 21:30 ` [PULL 26/30] hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle Michael S. Tsirkin
2026-07-26 21:30 ` [PULL 27/30] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation Michael S. Tsirkin
2026-07-26 21:30 ` [PULL 28/30] hw/net/virtio-net: Protect from DMA re-entrancy bugs Michael S. Tsirkin
2026-07-26 21:30 ` [PULL 29/30] hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) Michael S. Tsirkin
2026-07-26 21:30 ` [PULL 30/30] backends/rng: cap request size to avoid oversized allocation Michael S. Tsirkin
2026-07-27  8:55 ` [PULL 00/30] pci, vhost, virtio, iommu: bugfixes Michael S. Tsirkin
2026-07-27  9:05   ` Marc-André Lureau

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2fac08ccceeeb57132584af6e06aae5dfdff87fa.1785101237.git.mst@redhat.com \
    --to=mst@redhat.com \
    --cc=d-tatianin@yandex-team.ru \
    --cc=lizhaoxin04@baidu.com \
    --cc=pbonzini@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    --cc=vsementsov@yandex-team.ru \
    --cc=zhaoguohan@kylinos.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.