* [Qemu-devel] [FIX PATCH] monitor: Don't return CPU marked for unplug as monitor CPU
@ 2017-10-16 7:03 Bharata B Rao
2017-10-16 9:09 ` Igor Mammedov
0 siblings, 1 reply; 2+ messages in thread
From: Bharata B Rao @ 2017-10-16 7:03 UTC (permalink / raw)
To: qemu-devel; +Cc: dgilbert, armbru, sathnaga, Bharata B Rao
The following sequence of steps kill the QEMU:
- Hotplug a CPU
- Change the default CPU to the newly hotplugged cpu using "cpu" HMP command.
- Hot unplug the CPU
- Run "info cpus"
Fix this by not letting monitor_get_cpu() to return a CPU which is marked
for unplug.
Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
---
monitor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/monitor.c b/monitor.c
index fe0d1bd..8d60e57 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1053,7 +1053,7 @@ int monitor_set_cpu(int cpu_index)
CPUState *mon_get_cpu(void)
{
- if (!cur_mon->mon_cpu) {
+ if (!cur_mon->mon_cpu || cur_mon->mon_cpu->unplug) {
if (!first_cpu) {
return NULL;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [FIX PATCH] monitor: Don't return CPU marked for unplug as monitor CPU
2017-10-16 7:03 [Qemu-devel] [FIX PATCH] monitor: Don't return CPU marked for unplug as monitor CPU Bharata B Rao
@ 2017-10-16 9:09 ` Igor Mammedov
0 siblings, 0 replies; 2+ messages in thread
From: Igor Mammedov @ 2017-10-16 9:09 UTC (permalink / raw)
To: Bharata B Rao; +Cc: qemu-devel, sathnaga, dgilbert, armbru, Greg Kurz
On Mon, 16 Oct 2017 12:33:26 +0530
Bharata B Rao <bharata@linux.vnet.ibm.com> wrote:
> The following sequence of steps kill the QEMU:
>
> - Hotplug a CPU
> - Change the default CPU to the newly hotplugged cpu using "cpu" HMP command.
> - Hot unplug the CPU
> - Run "info cpus"
>
> Fix this by not letting monitor_get_cpu() to return a CPU which is marked
> for unplug.
>
> Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
> Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
> ---
> monitor.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/monitor.c b/monitor.c
> index fe0d1bd..8d60e57 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -1053,7 +1053,7 @@ int monitor_set_cpu(int cpu_index)
>
> CPUState *mon_get_cpu(void)
> {
> - if (!cur_mon->mon_cpu) {
> + if (!cur_mon->mon_cpu || cur_mon->mon_cpu->unplug) {
mon_cpu could be freed so it would cause use after free,
Greg was looking into the same issue see his patch:
"PATCH] monitor: fix dangling CPU pointer"
> if (!first_cpu) {
> return NULL;
> }
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-10-16 9:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-16 7:03 [Qemu-devel] [FIX PATCH] monitor: Don't return CPU marked for unplug as monitor CPU Bharata B Rao
2017-10-16 9:09 ` Igor Mammedov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).