From: Richard Henderson <richard.henderson@linaro.org>
To: "Alex Bennée" <alex.bennee@linaro.org>, qemu-devel@nongnu.org
Subject: Re: [PATCH 18/26] cpu: free cpu->tb_jmp_cache with RCU
Date: Wed, 11 Jan 2023 09:08:59 -1000 [thread overview]
Message-ID: <52ebe6d2-3c63-6cb4-5ae2-99168d6a922f@linaro.org> (raw)
In-Reply-To: <20230110173922.265055-19-alex.bennee@linaro.org>
On 1/10/23 09:39, Alex Bennée wrote:
> From: Emilio Cota<cota@braap.org>
>
> Fixes the appended use-after-free. The root cause is that
> during tb invalidation we use CPU_FOREACH, and therefore
> to safely free a vCPU we must wait for an RCU grace period
> to elapse.
>
> $ x86_64-linux-user/qemu-x86_64 tests/tcg/x86_64-linux-user/munmap-pthread
> =================================================================
> ==1800604==ERROR: AddressSanitizer: heap-use-after-free on address 0x62d0005f7418 at pc 0x5593da6704eb bp 0x7f4961a7ac70 sp 0x7f4961a7ac60
> READ of size 8 at 0x62d0005f7418 thread T2
> #0 0x5593da6704ea in tb_jmp_cache_inval_tb ../accel/tcg/tb-maint.c:244
> #1 0x5593da6704ea in do_tb_phys_invalidate ../accel/tcg/tb-maint.c:290
> #2 0x5593da670631 in tb_phys_invalidate__locked ../accel/tcg/tb-maint.c:306
> #3 0x5593da670631 in tb_invalidate_phys_page_range__locked ../accel/tcg/tb-maint.c:542
> #4 0x5593da67106d in tb_invalidate_phys_range ../accel/tcg/tb-maint.c:614
> #5 0x5593da6a64d4 in target_munmap ../linux-user/mmap.c:766
> #6 0x5593da6dba05 in do_syscall1 ../linux-user/syscall.c:10105
> #7 0x5593da6f564c in do_syscall ../linux-user/syscall.c:13329
> #8 0x5593da49e80c in cpu_loop ../linux-user/x86_64/../i386/cpu_loop.c:233
> #9 0x5593da6be28c in clone_func ../linux-user/syscall.c:6633
> #10 0x7f496231cb42 in start_thread nptl/pthread_create.c:442
> #11 0x7f49623ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
>
> 0x62d0005f7418 is located 28696 bytes inside of 32768-byte region [0x62d0005f0400,0x62d0005f8400)
> freed by thread T148 here:
> #0 0x7f49627b6460 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
> #1 0x5593da5ac057 in cpu_exec_unrealizefn ../cpu.c:180
> #2 0x5593da81f851 (/home/cota/src/qemu/build/qemu-x86_64+0x484851)
>
> Signed-off-by: Emilio Cota<cota@braap.org>
> Message-Id:<20230109224954.161672-2-cota@braap.org>
> Signed-off-by: Alex Bennée<alex.bennee@linaro.org>
> ---
> accel/tcg/tb-jmp-cache.h | 1 +
> accel/tcg/cpu-exec.c | 3 +--
> cpu.c | 11 ++++++++++-
> 3 files changed, 12 insertions(+), 3 deletions(-)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
r~
next prev parent reply other threads:[~2023-01-12 0:39 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-10 17:38 [PATCH 00/26] current maintainer trees (testing/semihosting/plugins) Alex Bennée
2023-01-10 17:38 ` [PATCH 01/26] scripts/ci: update gitlab-runner playbook to use latest runner Alex Bennée
2023-01-10 17:38 ` [PATCH 02/26] gitlab: add FF_SCRIPT_SECTIONS for timings Alex Bennée
2023-01-12 14:26 ` Thomas Huth
2023-01-10 17:38 ` [PATCH 03/26] gitlab: just use plain --cc=clang for custom runner build Alex Bennée
2023-01-11 18:50 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 04/26] tests/unit: drop hacky race avoidance in test-io-channel-command Alex Bennée
2023-01-12 12:21 ` Thomas Huth
2023-01-13 16:10 ` Marc-André Lureau
2023-01-10 17:39 ` [PATCH 05/26] build-sys: fix crlf-ending C code Alex Bennée
2023-01-10 17:39 ` [PATCH 06/26] .gitlab-ci.d/windows: do not disable opengl Alex Bennée
2023-01-10 17:39 ` [PATCH 07/26] configure: replace Perl usage with sed Alex Bennée
2023-01-13 8:29 ` Paolo Bonzini
2023-01-10 17:39 ` [PATCH 08/26] meson: replace Perl usage with Python Alex Bennée
2023-01-10 17:39 ` [PATCH 09/26] docs: drop texinfo options Alex Bennée
2023-01-10 17:39 ` [PATCH 10/26] Update lcitool and fedora to 37 Alex Bennée
2023-01-10 17:39 ` [PATCH 11/26] lcitool: drop perl from QEMU project/dependencies Alex Bennée
2023-01-10 17:39 ` [PATCH 12/26] lcitool: drop texinfo " Alex Bennée
2023-01-10 17:39 ` [PATCH 13/26] semihosting: Write back semihosting data before completion callback Alex Bennée
2023-01-10 17:39 ` [PATCH 14/26] semihosting: add O_BINARY flag in host_open for NT compatibility Alex Bennée
2023-01-10 17:39 ` [PATCH 15/26] docs: add a proper feature overview in "About QEMU" Alex Bennée
2023-01-10 17:39 ` [PATCH 16/26] semihosting: add semihosting section to the docs Alex Bennée
2023-01-11 19:06 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 17/26] tests/tcg: add memory-sve test for aarch64 Alex Bennée
2023-01-11 18:54 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 18/26] cpu: free cpu->tb_jmp_cache with RCU Alex Bennée
2023-01-11 19:08 ` Richard Henderson [this message]
2023-01-10 17:39 ` [PATCH 19/26] util/qht: add missing atomic_set(hashes[i]) Alex Bennée
2023-01-10 17:39 ` [PATCH 20/26] thread: de-const qemu_spin_destroy Alex Bennée
2023-01-11 19:09 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 21/26] util/qht: use striped locks under TSAN Alex Bennée
2023-01-11 19:10 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 22/26] plugins: make qemu_plugin_user_exit's locking order consistent with fork_start's Alex Bennée
2023-01-10 17:39 ` [PATCH 23/26] plugins: fix optimization in plugin_gen_disable_mem_helpers Alex Bennée
2023-01-10 17:39 ` [PATCH 24/26] translator: always pair plugin_gen_insn_{start, end} calls Alex Bennée
2023-01-11 19:11 ` Richard Henderson
2023-01-10 17:39 ` [PATCH 25/26] tcg: exclude lookup_tb_ptr from helper instrumentation Alex Bennée
2023-01-11 19:15 ` Richard Henderson
2023-01-12 9:52 ` Alex Bennée
2023-01-12 11:59 ` Alex Bennée
2023-01-10 17:39 ` [PATCH 26/26] cpu-exec: assert that plugin_mem_cbs is NULL after execution Alex Bennée
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52ebe6d2-3c63-6cb4-5ae2-99168d6a922f@linaro.org \
--to=richard.henderson@linaro.org \
--cc=alex.bennee@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).