[PULL for-8.0? 0/1] Bug fix for QEMU 8.0-rc4

[PULL for-8.0? 0/1] Bug fix for QEMU 8.0-rc4

[Paolo Bonzini]

The following changes since commit f00506aeca2f6d92318967693f8da8c713c163f3:

  Merge tag 'pull-tcg-20230328' of https://gitlab.com/rth7680/qemu into staging (2023-03-29 11:19:19 +0100)

are available in the Git repository at:

  https://gitlab.com/bonzini/qemu.git tags/for-upstream

for you to fetch changes up to 56adee407fc564da19e49cfe18e20e3da92320be:

  kvm: dirty-ring: Fix race with vcpu creation (2023-04-04 18:46:46 +0200)

----------------------------------------------------------------
Fix race condition that can cause a crash at startup.

----------------------------------------------------------------
Peter Xu (1):
      kvm: dirty-ring: Fix race with vcpu creation

 accel/kvm/kvm-all.c | 9 +++++++++
 1 file changed, 9 insertions(+)
-- 
2.39.2

[PULL 1/1] kvm: dirty-ring: Fix race with vcpu creation

[Paolo Bonzini]

From: Peter Xu <peterx@redhat.com>

It's possible that we want to reap a dirty ring on a vcpu that is during
creation, because the vcpu is put onto list (CPU_FOREACH visible) before
initialization of the structures.  In this case:

qemu_init_vcpu
    x86_cpu_realizefn
        cpu_exec_realizefn
            cpu_list_add      <---- can be probed by CPU_FOREACH
        qemu_init_vcpu
            cpus_accel->create_vcpu_thread(cpu);
                kvm_init_vcpu
                    map kvm_dirty_gfns  <--- kvm_dirty_gfns valid

Don't try to reap dirty ring on vcpus during creation or it'll crash.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2124756
Reported-by: Xiaohui Li <xiaohli@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <1d14deb6684bcb7de1c9633c5bd21113988cc698.1676563222.git.huangy81@chinatelecom.cn>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f2a6ea6a68a2..cf3a88d90e92 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -685,6 +685,15 @@ static uint32_t kvm_dirty_ring_reap_one(KVMState *s, CPUState *cpu)
     uint32_t ring_size = s->kvm_dirty_ring_size;
     uint32_t count = 0, fetch = cpu->kvm_fetch_index;
 
+    /*
+     * It's possible that we race with vcpu creation code where the vcpu is
+     * put onto the vcpus list but not yet initialized the dirty ring
+     * structures.  If so, skip it.
+     */
+    if (!cpu->created) {
+        return 0;
+    }
+
     assert(dirty_gfns && ring_size);
     trace_kvm_dirty_ring_reap_vcpu(cpu->cpu_index);
 
-- 
2.39.2

Re: [PULL for-8.0? 0/1] Bug fix for QEMU 8.0-rc4

[Peter Maydell]

On Tue, 4 Apr 2023 at 17:49, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> The following changes since commit f00506aeca2f6d92318967693f8da8c713c163f3:
>
>   Merge tag 'pull-tcg-20230328' of https://gitlab.com/rth7680/qemu into staging (2023-03-29 11:19:19 +0100)
>
> are available in the Git repository at:
>
>   https://gitlab.com/bonzini/qemu.git tags/for-upstream
>
> for you to fetch changes up to 56adee407fc564da19e49cfe18e20e3da92320be:
>
>   kvm: dirty-ring: Fix race with vcpu creation (2023-04-04 18:46:46 +0200)
>
> ----------------------------------------------------------------
> Fix race condition that can cause a crash at startup.
>
> ----------------------------------------------------------------
> Peter Xu (1):
>       kvm: dirty-ring: Fix race with vcpu creation
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.0
for any user-visible changes.

-- PMM