From: Michael Tokarev <mjt@tls.msk.ru>
To: Cindy Lu <lulu@redhat.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>,
qemu-devel@nongnu.org, qemu-stable@nongnu.org,
Lei Yang <leiyang@redhat.com>, Jason Wang <jasowang@redhat.com>
Subject: Re: [PATCH v8] virtio-pci: fix use of a released vector
Date: Thu, 9 May 2024 07:54:22 +0300 [thread overview]
Message-ID: <c2daf25b-8602-4457-9124-bc99d45b02fd@tls.msk.ru> (raw)
In-Reply-To: <CACLfguUF7+Kyafo-pkRpM94m-r7UPqet6xNuP6NDVXxAAD3ccQ@mail.gmail.com>
09.05.2024 04:43, Cindy Lu wrote:
>> https://gitlab.com/qemu-project/qemu/-/issues/2321
>> https://gitlab.com/qemu-project/qemu/-/issues/2334
>>
>> So something's not right here.
> I have checked the stack, seems there is a crash while set the vector
> to NO_VECTOER?
>
> #0 kvm_virtio_pci_vq_vector_release (proxy=0x55bd979fd130,
> vector=<optimized out>) at ../hw/virtio/virtio-pci.c:834
This is 8.2.3, not 9.0 or master. It is this line:
static void kvm_virtio_pci_vq_vector_release(VirtIOPCIProxy *proxy,
unsigned int vector)
{
VirtIOIRQFD *irqfd = &proxy->vector_irqfd[vector];
if (--irqfd->users == 0) { <=== this
kvm_irqchip_release_virq(kvm_state, irqfd->virq);
}
}
I wonder if we have a use-after-release issue here, which has been
uncovered by your fix..
/mjt
> #1 kvm_virtio_pci_vector_release_one
> (proxy=proxy@entry=0x55bd979fd130, queue_no=queue_no@entry=0) at
> ../hw/virtio/virtio-pci.c:965
> #2 0x000055bd9380c430 in virtio_pci_set_vector (vdev=0x55bd97a05500,
> proxy=0x55bd979fd130, queue_no=0, old_vector=1, new_vector=65535)
> at ../hw/virtio/virtio-pci.c:1445
> #3 0x000055bd939c5490 in memory_region_write_accessor
> (mr=0x55bd979fdc70, addr=26, value=<optimized out>, size=2,
> shift=<optimized out>,
> mask=<optimized out>, attrs=...) at ../system/memory.c:497
>
> I will try to reproduce and work in it
>
> thanks
> Cindy
prev parent reply other threads:[~2024-05-09 4:55 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-15 9:34 [PATCH v8] virtio-pci: fix use of a released vector Michael S. Tsirkin
2024-04-15 9:42 ` Cindy Lu
2024-04-15 10:40 ` Cindy Lu
2024-04-16 3:20 ` Jason Wang
2024-04-17 2:42 ` Cindy Lu
2024-05-08 20:17 ` Michael Tokarev
2024-05-09 1:43 ` Cindy Lu
2024-05-09 4:54 ` Michael Tokarev [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c2daf25b-8602-4457-9124-bc99d45b02fd@tls.msk.ru \
--to=mjt@tls.msk.ru \
--cc=jasowang@redhat.com \
--cc=leiyang@redhat.com \
--cc=lulu@redhat.com \
--cc=mst@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).