Re: [PATCH 5/5] accel/kvm: Fix SIGSEGV when execute "query-balloon" after CPR transfer

[Steven Sistare <steven.sistare@oracle.com>]

On 9/26/2025 12:48 AM, Markus Armbruster wrote:
> Zhenzhong Duan <zhenzhong.duan@intel.com> writes:
> 
>> After CPR transfer, source QEMU close kvm fd and free kvm_state,
>> "query-balloon" will check kvm_state->sync_mmu and trigger NULL
>> pointer reference.
>>
>> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
>> ---
>>   accel/kvm/kvm-all.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
>> index 9060599cd7..a3e2d11763 100644
>> --- a/accel/kvm/kvm-all.c
>> +++ b/accel/kvm/kvm-all.c
>> @@ -3479,7 +3479,7 @@ int kvm_device_access(int fd, int group, uint64_t attr,
>>   
>>   bool kvm_has_sync_mmu(void)
>>   {
>> -    return kvm_state->sync_mmu;
>> +    return kvm_state && kvm_state->sync_mmu;
>>   }
>>   
>>   int kvm_has_vcpu_events(void)
> 
> This dereference could signify there's a general assumption *kvm_state
> is valid, i.e. there might be more dereferences hiding in the code.
> 
> Have you checked?
> 
> Is freeing @kvm_state after CPR transfer useful?

There are other references to kvm_state which are checked by earlier cpr patches.
The risk/consequence of missing something is low, because this only occurs on source
QEMU after the target is live.

The KVM instance is closed to release KVM page table references and speed execv
during cpr-exec mode.

- Steve