Re: [Qemu-devel] [FIX PATCH] monitor: Don't return CPU marked for unplug as monitor CPU

[Igor Mammedov <imammedo@redhat.com>]

On Mon, 16 Oct 2017 12:33:26 +0530
Bharata B Rao <bharata@linux.vnet.ibm.com> wrote:

> The following sequence of steps kill the QEMU:
> 
> - Hotplug a CPU
> - Change the default CPU to the newly hotplugged cpu using "cpu" HMP command.
> - Hot unplug the CPU
> - Run "info cpus"
> 
> Fix this by not letting monitor_get_cpu() to return a CPU which is marked
> for unplug.
> 
> Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
> Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
> ---
>  monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/monitor.c b/monitor.c
> index fe0d1bd..8d60e57 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -1053,7 +1053,7 @@ int monitor_set_cpu(int cpu_index)
>  
>  CPUState *mon_get_cpu(void)
>  {
> -    if (!cur_mon->mon_cpu) {
> +    if (!cur_mon->mon_cpu || cur_mon->mon_cpu->unplug) {
mon_cpu could be freed so it would cause use after free,
Greg was looking into the same issue see his patch:
"PATCH] monitor: fix dangling CPU pointer"



>          if (!first_cpu) {
>              return NULL;
>          }