* [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state
@ 2023-07-31 12:59 Gavin Shan
2023-07-31 13:00 ` David Hildenbrand
2023-07-31 13:55 ` Philippe Mathieu-Daudé
0 siblings, 2 replies; 4+ messages in thread
From: Gavin Shan @ 2023-07-31 12:59 UTC (permalink / raw)
To: qemu-arm; +Cc: qemu-devel, pbonzini, peter.maydell, philmd, david, shan.gavin
Runs into core dump on arm64 and the backtrace extracted from the
core dump is shown as below. It's caused by accessing uninitialized
@kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
memory region is added earlier than before.
main
qemu_init
configure_accelerators
qemu_opts_foreach
do_configure_accelerator
accel_init_machine
kvm_init
virt_kvm_type
virt_set_memmap
machine_memory_devices_init
memory_region_add_subregion
memory_region_add_subregion_common
memory_region_update_container_subregions
memory_region_transaction_begin
qemu_flush_coalesced_mmio_buffer
kvm_flush_coalesced_mmio_buffer
Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
uninitialized @kvm_state. With this applied, no crash is observed on
arm64.
Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
Signed-off-by: Gavin Shan <gshan@redhat.com>
---
v2: Bail early in kvm_flush_coalesced_mmio_buffer() on the uninitialized
@kvm_state and improved changelog (David/Peter)
---
accel/kvm/kvm-all.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 373d876c05..7b3da8dc3a 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2812,7 +2812,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
{
KVMState *s = kvm_state;
- if (s->coalesced_flush_in_progress) {
+ if (!s || s->coalesced_flush_in_progress) {
return;
}
--
2.41.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state
2023-07-31 12:59 [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state Gavin Shan
@ 2023-07-31 13:00 ` David Hildenbrand
2023-07-31 13:19 ` Peter Maydell
2023-07-31 13:55 ` Philippe Mathieu-Daudé
1 sibling, 1 reply; 4+ messages in thread
From: David Hildenbrand @ 2023-07-31 13:00 UTC (permalink / raw)
To: Gavin Shan, qemu-arm
Cc: qemu-devel, pbonzini, peter.maydell, philmd, shan.gavin
On 31.07.23 14:59, Gavin Shan wrote:
> Runs into core dump on arm64 and the backtrace extracted from the
> core dump is shown as below. It's caused by accessing uninitialized
> @kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
> ("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
> memory region is added earlier than before.
>
> main
> qemu_init
> configure_accelerators
> qemu_opts_foreach
> do_configure_accelerator
> accel_init_machine
> kvm_init
> virt_kvm_type
> virt_set_memmap
> machine_memory_devices_init
> memory_region_add_subregion
> memory_region_add_subregion_common
> memory_region_update_container_subregions
> memory_region_transaction_begin
> qemu_flush_coalesced_mmio_buffer
> kvm_flush_coalesced_mmio_buffer
>
> Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
> uninitialized @kvm_state. With this applied, no crash is observed on
> arm64.
>
> Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
> Signed-off-by: Gavin Shan <gshan@redhat.com>
> ---
> v2: Bail early in kvm_flush_coalesced_mmio_buffer() on the uninitialized
> @kvm_state and improved changelog (David/Peter)
> ---
> accel/kvm/kvm-all.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> index 373d876c05..7b3da8dc3a 100644
> --- a/accel/kvm/kvm-all.c
> +++ b/accel/kvm/kvm-all.c
> @@ -2812,7 +2812,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
> {
> KVMState *s = kvm_state;
>
> - if (s->coalesced_flush_in_progress) {
> + if (!s || s->coalesced_flush_in_progress) {
> return;
> }
>
Thanks Gavin!
Reviewed-by: David Hildenbrand <david@redhat.com>
--
Cheers,
David / dhildenb
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state
2023-07-31 13:00 ` David Hildenbrand
@ 2023-07-31 13:19 ` Peter Maydell
0 siblings, 0 replies; 4+ messages in thread
From: Peter Maydell @ 2023-07-31 13:19 UTC (permalink / raw)
To: David Hildenbrand
Cc: Gavin Shan, qemu-arm, qemu-devel, pbonzini, philmd, shan.gavin
On Mon, 31 Jul 2023 at 14:00, David Hildenbrand <david@redhat.com> wrote:
>
> On 31.07.23 14:59, Gavin Shan wrote:
> > Runs into core dump on arm64 and the backtrace extracted from the
> > core dump is shown as below. It's caused by accessing uninitialized
> > @kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
> > ("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
> > memory region is added earlier than before.
> >
> > main
> > qemu_init
> > configure_accelerators
> > qemu_opts_foreach
> > do_configure_accelerator
> > accel_init_machine
> > kvm_init
> > virt_kvm_type
> > virt_set_memmap
> > machine_memory_devices_init
> > memory_region_add_subregion
> > memory_region_add_subregion_common
> > memory_region_update_container_subregions
> > memory_region_transaction_begin
> > qemu_flush_coalesced_mmio_buffer
> > kvm_flush_coalesced_mmio_buffer
> >
> > Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
> > uninitialized @kvm_state. With this applied, no crash is observed on
> > arm64.
> >
> > Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
> > Signed-off-by: Gavin Shan <gshan@redhat.com>
> > ---
> > v2: Bail early in kvm_flush_coalesced_mmio_buffer() on the uninitialized
> > @kvm_state and improved changelog (David/Peter)
> > ---
> > accel/kvm/kvm-all.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> > index 373d876c05..7b3da8dc3a 100644
> > --- a/accel/kvm/kvm-all.c
> > +++ b/accel/kvm/kvm-all.c
> > @@ -2812,7 +2812,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
> > {
> > KVMState *s = kvm_state;
> >
> > - if (s->coalesced_flush_in_progress) {
> > + if (!s || s->coalesced_flush_in_progress) {
> > return;
> > }
> >
>
> Thanks Gavin!
>
> Reviewed-by: David Hildenbrand <david@redhat.com>
Applied to target-arm.next, thanks.
-- PMM
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state
2023-07-31 12:59 [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state Gavin Shan
2023-07-31 13:00 ` David Hildenbrand
@ 2023-07-31 13:55 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2023-07-31 13:55 UTC (permalink / raw)
To: Gavin Shan, qemu-arm
Cc: qemu-devel, pbonzini, peter.maydell, david, shan.gavin
On 31/7/23 14:59, Gavin Shan wrote:
> Runs into core dump on arm64 and the backtrace extracted from the
> core dump is shown as below. It's caused by accessing uninitialized
> @kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
> ("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
> memory region is added earlier than before.
>
> main
> qemu_init
> configure_accelerators
> qemu_opts_foreach
> do_configure_accelerator
> accel_init_machine
> kvm_init
> virt_kvm_type
> virt_set_memmap
> machine_memory_devices_init
> memory_region_add_subregion
> memory_region_add_subregion_common
> memory_region_update_container_subregions
> memory_region_transaction_begin
> qemu_flush_coalesced_mmio_buffer
> kvm_flush_coalesced_mmio_buffer
>
> Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
> uninitialized @kvm_state. With this applied, no crash is observed on
> arm64.
>
> Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
> Signed-off-by: Gavin Shan <gshan@redhat.com>
> ---
> v2: Bail early in kvm_flush_coalesced_mmio_buffer() on the uninitialized
> @kvm_state and improved changelog (David/Peter)
> ---
> accel/kvm/kvm-all.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-07-31 13:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-31 12:59 [PATCH v2] kvm: Fix crash due to access uninitialized kvm_state Gavin Shan
2023-07-31 13:00 ` David Hildenbrand
2023-07-31 13:19 ` Peter Maydell
2023-07-31 13:55 ` Philippe Mathieu-Daudé
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).