[PATCH 0/9] Various ASAN & tests fixes

[PATCH 0/9] Various ASAN & tests fixes

[Marc-André Lureau]

Hi,

Along with Fabiano
fixes (https://patchew.org/QEMU/20260903220523.2849019-1-farosas@suse.de/)
This clears the asan-enabled tests of reports in my build configurations.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Marc-André Lureau (9):
      tests: fix qemu:func-hexagon-linters
      tests/test_vhost_user_bridge: skip when running ASAN
      hw/misc/bcm2835_powermgt: free wdog timer on finalize
      tests/launchupdate-test: correct g_auto usage
      tests/launchupdate-test: correctly release qs
      tests/launchupdate-test: fix fw_cfg leak
      igvm: release found memory region on success
      igvm: make IgvmMemoryRegion a QOM
      hw/s390x/ipl: fix short SCSI loadparm buffer over-read

 backends/igvm.c                                   | 99 ++++++++++++++---------
 hw/misc/bcm2835_powermgt.c                        |  8 ++
 hw/s390x/ipl.c                                    | 10 +--
 include/system/igvm-internal.h                    |  9 ++-
 tests/functional/hexagon/test_systests.py         |  6 +-
 tests/functional/x86_64/test_vhost_user_bridge.py | 13 +++
 tests/qtest/launchupdate-test.c                   | 20 ++---
 tests/qtest/libqos/libqos.h                       |  2 +
 8 files changed, 104 insertions(+), 63 deletions(-)
---
base-commit: ff1d2d19d7e24893e2012d879f8e73077e17b9bd
change-id: 20260906-nohmp-next-771b029cc0f2

Best regards,
--  
Marc-André Lureau <marcandre.lureau@redhat.com>

[PATCH 1/9] tests: fix qemu:func-hexagon-linters

[Marc-André Lureau]

Fix pylint W1514: unspecified-encoding

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/functional/hexagon/test_systests.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/hexagon/test_systests.py b/tests/functional/hexagon/test_systests.py
index f36e015f5021..4b0546e7ad30 100755
--- a/tests/functional/hexagon/test_systests.py
+++ b/tests/functional/hexagon/test_systests.py
@@ -65,14 +65,14 @@ def test_fopen(self):
         import tempfile
         # The fopen binary has a short cmdline buffer; use a short path.
         dummy = os.path.join(tempfile.gettempdir(), "qemu_fopen_test.so")
-        with open(dummy, "w") as f:
+        with open(dummy, "w", encoding="utf-8") as f:
             f.write("valid\n")
         self.run_exit_zero("fopen", "-append", dummy)
 
     def test_ftrunc(self):
         """ftrunc truncates _testfile_ftrunc from 6 bytes to 1 byte."""
         ftrunc_path = self.scratch_file("_testfile_ftrunc")
-        with open(ftrunc_path, "w") as f:
+        with open(ftrunc_path, "w", encoding="utf-8") as f:
             f.write("valid\n")
         # Sleep 1 s so mtime change is observable
         time.sleep(1)
@@ -83,7 +83,7 @@ def test_ftrunc(self):
     def test_access(self):
         """access checks R_OK|W_OK on _testfile_access."""
         testfile = self.scratch_file("_testfile_access")
-        with open(testfile, "w") as f:
+        with open(testfile, "w", encoding="utf-8") as f:
             f.write("valid\n")
         self.run_exit_zero("access", "-append", testfile)
 

-- 
2.55.0.543.g5ebe2ebe4ea8

Re: [PATCH 1/9] tests: fix qemu:func-hexagon-linters

[Brian Cain]

On 9/6/2026 3:53 AM, Marc-André Lureau wrote:
> Fix pylint W1514: unspecified-encoding
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---


Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>


>   tests/functional/hexagon/test_systests.py | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/tests/functional/hexagon/test_systests.py b/tests/functional/hexagon/test_systests.py
> index f36e015f5021..4b0546e7ad30 100755
> --- a/tests/functional/hexagon/test_systests.py
> +++ b/tests/functional/hexagon/test_systests.py
> @@ -65,14 +65,14 @@ def test_fopen(self):
>           import tempfile
>           # The fopen binary has a short cmdline buffer; use a short path.
>           dummy = os.path.join(tempfile.gettempdir(), "qemu_fopen_test.so")
> -        with open(dummy, "w") as f:
> +        with open(dummy, "w", encoding="utf-8") as f:
>               f.write("valid\n")
>           self.run_exit_zero("fopen", "-append", dummy)
>   
>       def test_ftrunc(self):
>           """ftrunc truncates _testfile_ftrunc from 6 bytes to 1 byte."""
>           ftrunc_path = self.scratch_file("_testfile_ftrunc")
> -        with open(ftrunc_path, "w") as f:
> +        with open(ftrunc_path, "w", encoding="utf-8") as f:
>               f.write("valid\n")
>           # Sleep 1 s so mtime change is observable
>           time.sleep(1)
> @@ -83,7 +83,7 @@ def test_ftrunc(self):
>       def test_access(self):
>           """access checks R_OK|W_OK on _testfile_access."""
>           testfile = self.scratch_file("_testfile_access")
> -        with open(testfile, "w") as f:
> +        with open(testfile, "w", encoding="utf-8") as f:
>               f.write("valid\n")
>           self.run_exit_zero("access", "-append", testfile)
>   
>

[PATCH 2/9] tests/test_vhost_user_bridge: skip when running ASAN

[Marc-André Lureau]

Running vhost-user-bridge built with ASAN with stdbuf dies:
==2431898==ASan runtime does not come first in initial library list; you
should either link runtime to your application or manually preload it
with LD_PRELOAD.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/functional/x86_64/test_vhost_user_bridge.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tests/functional/x86_64/test_vhost_user_bridge.py b/tests/functional/x86_64/test_vhost_user_bridge.py
index c36c62542053..5fedf61c5e72 100755
--- a/tests/functional/x86_64/test_vhost_user_bridge.py
+++ b/tests/functional/x86_64/test_vhost_user_bridge.py
@@ -73,12 +73,25 @@ def configure_vm(self, ud_socket_path, lport, rport, hostfwd_port, tftpdir):
             "-netdev",   "hubport,id=hub1,hubid=0,netdev=user0"
         )
 
+    @staticmethod
+    def _is_asan_linked(binary_path):
+        try:
+            output = subprocess.check_output(
+                ["ldd", binary_path], stderr=subprocess.DEVNULL, text=True)
+            return "libasan" in output
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            return False
+
     def assemble_vubr_args(self, vubr_path, ud_socket_path, lport, rport):
         vubr_args = []
 
         if (stdbuf_path := which("stdbuf")) is None:
             self.log.info("Could not find stdbuf: vhost-user-bridge "
                           "log lines may appear out of order")
+        elif self._is_asan_linked(vubr_path):
+            self.log.info("vhost-user-bridge is ASan-linked: skipping "
+                          "stdbuf to avoid LD_PRELOAD conflict, "
+                          "log lines may appear out of order")
         else:
             vubr_args += [stdbuf_path, "-o0", "-e0"]
 

-- 
2.55.0.543.g5ebe2ebe4ea8

Re: [PATCH 2/9] tests/test_vhost_user_bridge: skip when running ASAN

[Michael S. Tsirkin]

does not look like this patch skips any tests?

On Sun, Sep 06, 2026 at 12:53:34PM +0400, Marc-André Lureau wrote:
> Running vhost-user-bridge built with ASAN with stdbuf dies:
> ==2431898==ASan runtime does not come first in initial library list; you
> should either link runtime to your application or manually preload it
> with LD_PRELOAD.

so it dies but why? judging by below because of stdbuf?

pls describe the fix not just the problem.

> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  tests/functional/x86_64/test_vhost_user_bridge.py | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/tests/functional/x86_64/test_vhost_user_bridge.py b/tests/functional/x86_64/test_vhost_user_bridge.py
> index c36c62542053..5fedf61c5e72 100755
> --- a/tests/functional/x86_64/test_vhost_user_bridge.py
> +++ b/tests/functional/x86_64/test_vhost_user_bridge.py
> @@ -73,12 +73,25 @@ def configure_vm(self, ud_socket_path, lport, rport, hostfwd_port, tftpdir):
>              "-netdev",   "hubport,id=hub1,hubid=0,netdev=user0"
>          )
>  
> +    @staticmethod
> +    def _is_asan_linked(binary_path):
> +        try:
> +            output = subprocess.check_output(
> +                ["ldd", binary_path], stderr=subprocess.DEVNULL, text=True)
> +            return "libasan" in output


this is quite a hack

> +        except (subprocess.CalledProcessError, FileNotFoundError):
> +            return False
> +
>      def assemble_vubr_args(self, vubr_path, ud_socket_path, lport, rport):
>          vubr_args = []
>  
>          if (stdbuf_path := which("stdbuf")) is None:
>              self.log.info("Could not find stdbuf: vhost-user-bridge "
>                            "log lines may appear out of order")
> +        elif self._is_asan_linked(vubr_path):
> +            self.log.info("vhost-user-bridge is ASan-linked: skipping "
> +                          "stdbuf to avoid LD_PRELOAD conflict, "
> +                          "log lines may appear out of order")
>          else:
>              vubr_args += [stdbuf_path, "-o0", "-e0"]
>  


maybe just avoid stdbuf completely.
i don't remember why we use it, but it looks like merely to
disable buffering for stdout?

If so:

setvbuf(stdout, NULL, _IONBF, 0);

will do just that with no asan issues.


> -- 
> 2.55.0.543.g5ebe2ebe4ea8
> 
> 

Re: [PATCH 2/9] tests/test_vhost_user_bridge: skip when running ASAN

[Marc-André Lureau]

Hi

On Mon, Sep 7, 2026 at 4:03 PM Michael S. Tsirkin <mst@redhat.com> wrote:
>
> does not look like this patch skips any tests?
>

true, I will update the commit title

> On Sun, Sep 06, 2026 at 12:53:34PM +0400, Marc-André Lureau wrote:
> > Running vhost-user-bridge built with ASAN with stdbuf dies:
> > ==2431898==ASan runtime does not come first in initial library list; you
> > should either link runtime to your application or manually preload it
> > with LD_PRELOAD.
>
> so it dies but why? judging by below because of stdbuf?
>
> pls describe the fix not just the problem.

Running vhost-user-bridge built with ASAN with stdbuf dies:
==2431898==ASan runtime does not come first in initial library

The fix skip using stdbuf when the binary is built with ASAN, since it
seems optional anyway

>
> > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > ---
> >  tests/functional/x86_64/test_vhost_user_bridge.py | 13 +++++++++++++
> >  1 file changed, 13 insertions(+)
> >
> > diff --git a/tests/functional/x86_64/test_vhost_user_bridge.py b/tests/functional/x86_64/test_vhost_user_bridge.py
> > index c36c62542053..5fedf61c5e72 100755
> > --- a/tests/functional/x86_64/test_vhost_user_bridge.py
> > +++ b/tests/functional/x86_64/test_vhost_user_bridge.py
> > @@ -73,12 +73,25 @@ def configure_vm(self, ud_socket_path, lport, rport, hostfwd_port, tftpdir):
> >              "-netdev",   "hubport,id=hub1,hubid=0,netdev=user0"
> >          )
> >
> > +    @staticmethod
> > +    def _is_asan_linked(binary_path):
> > +        try:
> > +            output = subprocess.check_output(
> > +                ["ldd", binary_path], stderr=subprocess.DEVNULL, text=True)
> > +            return "libasan" in output
>
>
> this is quite a hack

yeah

>
> > +        except (subprocess.CalledProcessError, FileNotFoundError):
> > +            return False
> > +
> >      def assemble_vubr_args(self, vubr_path, ud_socket_path, lport, rport):
> >          vubr_args = []
> >
> >          if (stdbuf_path := which("stdbuf")) is None:
> >              self.log.info("Could not find stdbuf: vhost-user-bridge "
> >                            "log lines may appear out of order")
> > +        elif self._is_asan_linked(vubr_path):
> > +            self.log.info("vhost-user-bridge is ASan-linked: skipping "
> > +                          "stdbuf to avoid LD_PRELOAD conflict, "
> > +                          "log lines may appear out of order")
> >          else:
> >              vubr_args += [stdbuf_path, "-o0", "-e0"]
> >
>
>
> maybe just avoid stdbuf completely.
> i don't remember why we use it, but it looks like merely to
> disable buffering for stdout?
>
> If so:
>
> setvbuf(stdout, NULL, _IONBF, 0);
>
> will do just that with no asan issues.
>

That requires modifying vhost-user-bridge, not sure that's what we want.

thanks

Re: [PATCH 2/9] tests/test_vhost_user_bridge: skip when running ASAN

[Michael S. Tsirkin]

On Mon, Sep 07, 2026 at 05:22:43PM +0400, Marc-André Lureau wrote:
> > maybe just avoid stdbuf completely.
> > i don't remember why we use it, but it looks like merely to
> > disable buffering for stdout?
> >
> > If so:
> >
> > setvbuf(stdout, NULL, _IONBF, 0);
> >
> > will do just that with no asan issues.
> >
> 
> That requires modifying vhost-user-bridge, not sure that's what we want.
> 
> thanks

why not? it's not like it's a facility useful outside of testing qemu.
If we were we'd probably disable stdout printout completely.

-- 
MST

[PATCH 3/9] hw/misc/bcm2835_powermgt: free wdog timer on finalize

[Marc-André Lureau]

The wdog_timer allocated in instance_init  is causing ASAN to report a
leak when the object is destroyed (e.g. during qom-test and
device-introspect-test).

Add an instance_finalize handler to free it.

Fixes: 21fcfb604608 ("hw/misc/bcm2835_powermgt: implement a real watchdog timer")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/misc/bcm2835_powermgt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/misc/bcm2835_powermgt.c b/hw/misc/bcm2835_powermgt.c
index 7b01be48bb7f..1de5a55a4f5b 100644
--- a/hw/misc/bcm2835_powermgt.c
+++ b/hw/misc/bcm2835_powermgt.c
@@ -152,6 +152,13 @@ static void bcm2835_powermgt_init(Object *obj)
                                  bcm2835_powermgt_expire, s);
 }
 
+static void bcm2835_powermgt_finalize(Object *obj)
+{
+    BCM2835PowerMgtState *s = BCM2835_POWERMGT(obj);
+
+    timer_free(s->wdog_timer);
+}
+
 static void bcm2835_powermgt_reset(DeviceState *dev)
 {
     BCM2835PowerMgtState *s = BCM2835_POWERMGT(dev);
@@ -177,6 +184,7 @@ static const TypeInfo bcm2835_powermgt_info = {
     .instance_size = sizeof(BCM2835PowerMgtState),
     .class_init    = bcm2835_powermgt_class_init,
     .instance_init = bcm2835_powermgt_init,
+    .instance_finalize = bcm2835_powermgt_finalize,
 };
 
 static void bcm2835_powermgt_register_types(void)

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 4/9] tests/launchupdate-test: correct g_auto usage

[Marc-André Lureau]

g_free() isn't the appropriate way to release those types.

Fixes: 0b70c6ce7b31 ("Add functional and unit tests for the vm-launch-update device")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/qtest/launchupdate-test.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/launchupdate-test.c b/tests/qtest/launchupdate-test.c
index 225c843df5b9..ed007cdce29f 100644
--- a/tests/qtest/launchupdate-test.c
+++ b/tests/qtest/launchupdate-test.c
@@ -192,8 +192,8 @@ static guint32 match_string(char *serial_f, const char *exp_out)
 {
     GError *error = NULL;
     g_autofree gchar *f_contents = NULL;
-    g_autofree GRegex *regex = NULL;
-    g_autofree GMatchInfo *match_info = NULL;
+    g_autoptr(GRegex) regex = NULL;
+    g_autoptr(GMatchInfo) match_info = NULL;
     gsize len;
     guint32 count = 0;
     gboolean ret;
@@ -214,7 +214,6 @@ static guint32 match_string(char *serial_f, const char *exp_out)
         g_match_info_next(match_info, &error);
         count++;
     }
-    g_regex_unref(regex);
     return count;
 }
 

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 5/9] tests/launchupdate-test: correctly release qs

[Marc-André Lureau]

QOSState must be released with qtest_shutdown().

Fixes: 0b70c6ce7b31 ("Add functional and unit tests for the vm-launch-update device")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/qtest/launchupdate-test.c | 14 +++++---------
 tests/qtest/libqos/libqos.h     |  2 ++
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/tests/qtest/launchupdate-test.c b/tests/qtest/launchupdate-test.c
index ed007cdce29f..12a09079ae91 100644
--- a/tests/qtest/launchupdate-test.c
+++ b/tests/qtest/launchupdate-test.c
@@ -51,7 +51,7 @@ static void test_vm_launch_update_capability(void)
 static void test_vm_launch_update_disable(void)
 {
     QFWCFG *fw_cfg;
-    QOSState *qs;
+    g_autoptr(QOSState) qs = NULL;
     VMLaunchUpdate launch_update;
     uint64_t control;
     size_t filesize;
@@ -95,13 +95,12 @@ static void test_vm_launch_update_disable(void)
     g_assert_cmpint(VM_LAUNCHUPDATE_CTL_DISABLE & control, ==, 1);
 
     pc_fw_cfg_uninit(fw_cfg);
-    qtest_shutdown(qs);
 }
 
 static void check_error(void)
 {
     QFWCFG *fw_cfg;
-    QOSState *qs;
+    g_autoptr(QOSState) qs = NULL;
     VMLaunchUpdate launch_update;
     uint16_t status;
     size_t filesize;
@@ -149,6 +148,7 @@ static void check_error(void)
     status = le64_to_cpu(launch_update.status);
     /* should fail with LOAD_FAIL since it was not IGVM format */
     g_assert_cmpint(status, ==, VM_LAUNCHUPDATE_LOAD_FAIL);
+
 }
 
 static int64_t get_image_size(const char *filename)
@@ -326,7 +326,7 @@ static void test_load_igvm(void)
     size_t igvm_sz;
     size_t filesize;
     QFWCFG *fw_cfg;
-    QOSState *qs;
+    g_autoptr(QOSState) qs = NULL;
     VMLaunchUpdate launch_update;
 
     if (!trace) {
@@ -456,8 +456,6 @@ static void test_load_igvm(void)
     close(ser_fd);
     guest_free(&qs->alloc, gaddr);
     pc_fw_cfg_uninit(fw_cfg);
-    /* qtest_quit() kils QEMU, first by sending SIGTERM, then SIGKILL */
-    qtest_quit(qs->qts);
 }
 
 static void test_set_ctrl_once_and_reset_to_host_igvm(void)
@@ -475,7 +473,7 @@ static void test_set_ctrl_once_and_reset_to_host_igvm(void)
     size_t igvm_sz;
     size_t filesize;
     QFWCFG *fw_cfg;
-    QOSState *qs;
+    g_autoptr(QOSState) qs = NULL;
     VMLaunchUpdate launch_update;
 
     if (!qtest_has_machine("q35")) {
@@ -585,8 +583,6 @@ static void test_set_ctrl_once_and_reset_to_host_igvm(void)
     close(ser_fd);
     guest_free(&qs->alloc, gaddr);
     pc_fw_cfg_uninit(fw_cfg);
-    /* qtest_quit() kils QEMU, first by sending SIGTERM, then SIGKILL */
-    qtest_quit(qs->qts);
 }
 
 int main(int argc, char **argv)
diff --git a/tests/qtest/libqos/libqos.h b/tests/qtest/libqos/libqos.h
index c04950e2b19d..b2d02825a9af 100644
--- a/tests/qtest/libqos/libqos.h
+++ b/tests/qtest/libqos/libqos.h
@@ -42,4 +42,6 @@ static inline void qfree(QOSState *q, uint64_t addr)
     guest_free(&q->alloc, addr);
 }
 
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(QOSState, qtest_shutdown)
+
 #endif

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 6/9] tests/launchupdate-test: fix fw_cfg leak

[Marc-André Lureau]

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/qtest/launchupdate-test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/launchupdate-test.c b/tests/qtest/launchupdate-test.c
index 12a09079ae91..beec902caa6a 100644
--- a/tests/qtest/launchupdate-test.c
+++ b/tests/qtest/launchupdate-test.c
@@ -149,6 +149,7 @@ static void check_error(void)
     /* should fail with LOAD_FAIL since it was not IGVM format */
     g_assert_cmpint(status, ==, VM_LAUNCHUPDATE_LOAD_FAIL);
 
+    pc_fw_cfg_uninit(fw_cfg);
 }
 
 static int64_t get_image_size(const char *filename)

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 7/9] igvm: release found memory region on success

[Marc-André Lureau]

Not only in error paths must the mrs.mr be released.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 backends/igvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backends/igvm.c b/backends/igvm.c
index 7b7bdc72b75b..784a56504e77 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -236,9 +236,9 @@ static void *qigvm_prepare_memory(QIgvm *ctx, uint64_t addr, uint64_t size,
             return NULL;
         }
 
+        memory_region_unref(mrs.mr);
         gpa_region_size = int128_make64(size);
         if (int128_lt(mrs.size, gpa_region_size)) {
-            memory_region_unref(mrs.mr);
             error_setg(
                 errp,
                 "Processing of IGVM file failed: Could not prepare memory "

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 8/9] igvm: make IgvmMemoryRegion a QOM

[Marc-André Lureau]

Make IgvmMemoryRegion a QOM object, embedding MemoryRegion, and use it
as the region owner. The IGVM list and memory subsystem can now hold
references independently, and QOM frees after the last reference is
dropped, fixing leaks reported by ASAN while running tests.

- object_unparent() is no longer needed, children are automatically unref
- switch to memory_region_init_ram_flags_nomigrate() as other helpers
  expect a DEVICE

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 backends/igvm.c                | 97 +++++++++++++++++++++++++-----------------
 include/system/igvm-internal.h |  9 ++--
 2 files changed, 64 insertions(+), 42 deletions(-)

diff --git a/backends/igvm.c b/backends/igvm.c
index 784a56504e77..6cd192f2f5ff 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -35,6 +35,12 @@
 #define IGVM_VHT_OPTIONAL_BIT (1U << 31)
 #endif
 
+struct IgvmMemoryRegion {
+    Object parent_obj;
+    MemoryRegion mr;
+    QTAILQ_ENTRY(IgvmMemoryRegion) next;
+};
+
 /*
  * Bit 31 of the variable header type indicates that the header is
  * optional and can be safely ignored by a loader that does not
@@ -221,10 +227,13 @@ static void *qigvm_prepare_memory(QIgvm *ctx, uint64_t addr, uint64_t size,
                                   int region_identifier, Error **errp)
 {
     ERRP_GUARD();
-    IgvmMemoryRegion *imr = NULL;
+    g_autoptr(IgvmMemoryRegion) imr = NULL;
     Int128 gpa_region_size;
+    g_autofree char *region_name = NULL;
+    uint32_t flags = 0;
     MemoryRegionSection mrs =
         memory_region_find(get_system_memory(), addr, size);
+
     if (mrs.mr) {
         if (!memory_region_is_ram(mrs.mr)) {
             memory_region_unref(mrs.mr);
@@ -247,36 +256,29 @@ static void *qigvm_prepare_memory(QIgvm *ctx, uint64_t addr, uint64_t size,
             return NULL;
         }
         return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
-    } else {
-        /*
-         * The region_identifier is the is the index of the IGVM directive that
-         * contains the page with the lowest GPA in the region. This will
-         * generate a unique region name.
-         */
-        g_autofree char *region_name =
-            g_strdup_printf("igvm.%X", region_identifier);
-        imr = g_new0(IgvmMemoryRegion, 1);
-        imr->mr = g_new0(MemoryRegion, 1);
-        if (ctx->machine_state->cgs &&
-            ctx->machine_state->cgs->require_guest_memfd) {
-            if (!memory_region_init_ram_guest_memfd(imr->mr, NULL,
-                                                    region_name, size, errp)) {
-                g_free(imr->mr);
-                g_free(imr);
-                return NULL;
-            }
-        } else {
-            if (!memory_region_init_ram(imr->mr, NULL, region_name, size,
-                                        errp)) {
-                g_free(imr->mr);
-                g_free(imr);
-                return NULL;
-            }
-        }
-        memory_region_add_subregion(get_system_memory(), addr, imr->mr);
-        QTAILQ_INSERT_TAIL(&ctx->cfg->memory_regions, imr, next);
-        return memory_region_get_ram_ptr(imr->mr);
     }
+
+    /*
+     * The region_identifier is the is the index of the IGVM directive that
+     * contains the page with the lowest GPA in the region. This will
+     * generate a unique region name.
+     */
+    region_name = g_strdup_printf("igvm.%X", region_identifier);
+    imr = IGVM_MEMORY_REGION(object_new(TYPE_IGVM_MEMORY_REGION));
+    if (ctx->machine_state->cgs &&
+        ctx->machine_state->cgs->require_guest_memfd) {
+        flags = RAM_GUEST_MEMFD;
+    }
+    if (!memory_region_init_ram_flags_nomigrate(&imr->mr, OBJECT(imr),
+                                                region_name, size,
+                                                flags, errp)) {
+        return NULL;
+    }
+    vmstate_register_ram_global(&imr->mr);
+    memory_region_add_subregion(get_system_memory(), addr, &imr->mr);
+    object_ref(imr); /* for the list */
+    QTAILQ_INSERT_TAIL(&ctx->cfg->memory_regions, imr, next);
+    return memory_region_get_ram_ptr(&imr->mr);
 }
 
 static int qigvm_type_to_cgs_type(IgvmPageDataType memory_type, bool unmeasured,
@@ -1118,14 +1120,33 @@ void qigvm_cleanup_memory(IgvmCfg *cfg)
 {
     IgvmMemoryRegion *imr, *tmp;
 
-    QTAILQ_FOREACH_SAFE(imr, &cfg->memory_regions, next, tmp)
-    {
-        trace_qigvm_cleanup_memory(imr->mr->name);
-        memory_region_del_subregion(get_system_memory(), imr->mr);
-        vmstate_unregister_ram(imr->mr, NULL);
+    QTAILQ_FOREACH_SAFE(imr, &cfg->memory_regions, next, tmp) {
+        trace_qigvm_cleanup_memory(imr->mr.name);
         QTAILQ_REMOVE(&cfg->memory_regions, imr, next);
-        /* this triggers MemoryRegion cleanup */
-        object_unparent(OBJECT(imr->mr));
-        g_free(imr);
+        object_unref(OBJECT(imr));
     }
 }
+
+static void qigvm_memory_region_finalize(Object *obj)
+{
+    IgvmMemoryRegion *imr = IGVM_MEMORY_REGION(obj);
+
+    if (imr->mr.container) {
+        memory_region_del_subregion(imr->mr.container, &imr->mr);
+    }
+    vmstate_unregister_ram(&imr->mr, NULL);
+}
+
+static const TypeInfo qigvm_memory_region_info = {
+    .name = TYPE_IGVM_MEMORY_REGION,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(IgvmMemoryRegion),
+    .instance_finalize = qigvm_memory_region_finalize,
+};
+
+static void qigvm_register_types(void)
+{
+    type_register_static(&qigvm_memory_region_info);
+}
+
+type_init(qigvm_register_types);
diff --git a/include/system/igvm-internal.h b/include/system/igvm-internal.h
index 9e9fa1d9afdb..625d2f9a9f83 100644
--- a/include/system/igvm-internal.h
+++ b/include/system/igvm-internal.h
@@ -18,10 +18,11 @@
 #include "system/confidential-guest-support.h"
 #include <igvm/igvm.h>
 
-typedef struct IgvmMemoryRegion {
-    QTAILQ_ENTRY(IgvmMemoryRegion) next;
-    MemoryRegion *mr;
-} IgvmMemoryRegion;
+typedef struct IgvmMemoryRegion IgvmMemoryRegion;
+
+#define TYPE_IGVM_MEMORY_REGION "igvm-memory-region"
+
+OBJECT_DECLARE_SIMPLE_TYPE(IgvmMemoryRegion, IGVM_MEMORY_REGION)
 
 struct IgvmCfg {
     Object parent_obj;

-- 
2.55.0.543.g5ebe2ebe4ea8

[PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read

[Marc-André Lureau]

s390_build_iplb() initially points lp at the eight-byte CCW loadparm
array. For SCSI devices, it can replace lp with a variable-length string
returned by object_property_get_str().

The following memcmp() still reads eight bytes. ASan reports
buffer-overflow on value "3", when running test_scsi_loadparm
func-s390x-boot_4k test.

Check the fixed-size CCW loadparm for the 8-zero before the SCSI
property can replace lp.

Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/s390x/ipl.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c7839..e249d50b1ce3 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -549,6 +549,11 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
     if (ccw_dev) {
         lp = ccw_dev->loadparm;
 
+        /* If the device loadparm is empty use the global machine loadparm */
+        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
+            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
+        }
+
         switch (devtype) {
         case CCW_DEVTYPE_SCSI:
             sd = SCSI_DEVICE(dev_st);
@@ -583,11 +588,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
             break;
         }
 
-        /* If the device loadparm is empty use the global machine loadparm */
-        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
-            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
-        }
-
         s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
         iplb->flags |= DIAG308_FLAGS_LP_VALID;
 

-- 
2.55.0.543.g5ebe2ebe4ea8

Re: [PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read

[Jared Rossi]

On 9/6/26 4:53 AM, Marc-André Lureau wrote:
> s390_build_iplb() initially points lp at the eight-byte CCW loadparm
> array. For SCSI devices, it can replace lp with a variable-length string
> returned by object_property_get_str().
>
> The following memcmp() still reads eight bytes. ASan reports
> buffer-overflow on value "3", when running test_scsi_loadparm
> func-s390x-boot_4k test.
>
> Check the fixed-size CCW loadparm for the 8-zero before the SCSI
> property can replace lp.
>
> Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>

>   hw/s390x/ipl.c | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c7839..e249d50b1ce3 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -549,6 +549,11 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>       if (ccw_dev) {
>           lp = ccw_dev->loadparm;
>   
> +        /* If the device loadparm is empty use the global machine loadparm */
> +        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
> +            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
> +        }
> +
>           switch (devtype) {
>           case CCW_DEVTYPE_SCSI:
>               sd = SCSI_DEVICE(dev_st);
> @@ -583,11 +588,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>               break;
>           }
>   
> -        /* If the device loadparm is empty use the global machine loadparm */
> -        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
> -            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
> -        }
> -
>           s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>           iplb->flags |= DIAG308_FLAGS_LP_VALID;
>   
>

Re: [PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read

[Eric Farman]

On 9/6/26 4:53 AM, Marc-André Lureau wrote:
> s390_build_iplb() initially points lp at the eight-byte CCW loadparm
> array. For SCSI devices, it can replace lp with a variable-length string
> returned by object_property_get_str().
> 
> The following memcmp() still reads eight bytes. ASan reports
> buffer-overflow on value "3", when running test_scsi_loadparm
> func-s390x-boot_4k test.
> 
> Check the fixed-size CCW loadparm for the 8-zero before the SCSI
> property can replace lp.
> 
> Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/s390x/ipl.c | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)

Reviewed-by: Eric Farman <farman@linux.ibm.com>