From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39433) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bSyHU-0005iF-Ju for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bSyHP-0002u2-J3 for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46538) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bSyHP-0002tg-Dp for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:07 -0400 Date: Fri, 29 Jul 2016 06:16:03 +0300 From: "Michael S. Tsirkin" Message-ID: <1469762011-7902-18-git-send-email-mst@redhat.com> References: <1469762011-7902-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: <1469762011-7902-1-git-send-email-mst@redhat.com> Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PULL 17/41] vhost: fix cleanup on not fully initialized device List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , =?iso-8859-1?Q?Marc-Andr=E9?= Lureau From: Marc-Andr=E9 Lureau If vhost_dev_init() failed, caller may still call vhost_dev_cleanup() later. However, vhost_dev_cleanup() tries to remove the device from the list even if it wasn't yet added, which may lead to crashes. Similarly for the memory listener. Signed-off-by: Marc-Andr=E9 Lureau Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/vhost.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 8a18f9b..6b988e1 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -1033,7 +1033,6 @@ int vhost_dev_init(struct vhost_dev *hdev, void *op= aque, r =3D -1; goto fail; } - QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); =20 r =3D hdev->vhost_ops->vhost_set_owner(hdev); if (r < 0) { @@ -1103,6 +1102,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *op= aque, hdev->started =3D false; hdev->memory_changed =3D false; memory_listener_register(&hdev->memory_listener, &address_space_memo= ry); + QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); return 0; fail_busyloop: while (--i >=3D 0) { @@ -1126,7 +1126,11 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) for (i =3D 0; i < hdev->nvqs; ++i) { vhost_virtqueue_cleanup(hdev->vqs + i); } - memory_listener_unregister(&hdev->memory_listener); + if (hdev->mem) { + /* those are only safe after successful init */ + memory_listener_unregister(&hdev->memory_listener); + QLIST_REMOVE(hdev, entry); + } if (hdev->migration_blocker) { migrate_del_blocker(hdev->migration_blocker); error_free(hdev->migration_blocker); @@ -1135,7 +1139,6 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) g_free(hdev->mem_sections); hdev->vhost_ops->vhost_backend_cleanup(hdev); assert(!hdev->log); - QLIST_REMOVE(hdev, entry); } =20 /* Stop processing guest IO notifications in qemu. --=20 MST