aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorPrasad Pandit <pjp@fedoraproject.org>2023-05-29 17:13:32 +0530
committerMichael S. Tsirkin <mst@redhat.com>2023-06-23 02:54:44 -0400
commit1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16 (patch)
tree45384a867a888a66dcd0f0c890154fd2aba8ed87 /hw
parent7a0903f7ea8ac7e5b3191c9a2cfd1751b153f48c (diff)
downloadqemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.zip
qemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.tar.gz
qemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.tar.bz2
vhost: release memory_listener object in error path
vhost_dev_start function does not release memory_listener object in case of an error. This may crash the guest when vhost is unable to set memory table: stack trace of thread 125653: Program terminated with signal SIGSEGV, Segmentation fault #0 memory_listener_register (qemu-kvm + 0x6cda0f) #1 vhost_dev_start (qemu-kvm + 0x699301) #2 vhost_net_start (qemu-kvm + 0x45b03f) #3 virtio_net_set_status (qemu-kvm + 0x665672) #4 qmp_set_link (qemu-kvm + 0x548fd5) #5 net_vhost_user_event (qemu-kvm + 0x552c45) #6 tcp_chr_connect (qemu-kvm + 0x88d473) #7 tcp_chr_new_client (qemu-kvm + 0x88cf83) #8 tcp_chr_accept (qemu-kvm + 0x88b429) #9 qio_net_listener_channel_func (qemu-kvm + 0x7ac07c) #10 g_main_context_dispatch (libglib-2.0.so.0 + 0x54e2f) Release memory_listener objects in the error path. Signed-off-by: Prasad Pandit <pjp@fedoraproject.org> Message-Id: <20230529114333.31686-2-ppandit@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Fixes: c471ad0e9b ("vhost_net: device IOTLB support") Cc: qemu-stable@nongnu.org Acked-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/virtio/vhost.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 7f3c727..7e1f556 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -2003,6 +2003,9 @@ fail_vq:
}
fail_mem:
+ if (vhost_dev_has_iommu(hdev)) {
+ memory_listener_unregister(&hdev->iommu_listener);
+ }
fail_features:
vdev->vhost_started = false;
hdev->started = false;