diff options
author | Prasad Pandit <pjp@fedoraproject.org> | 2023-05-29 17:13:32 +0530 |
---|---|---|
committer | Michael S. Tsirkin <mst@redhat.com> | 2023-06-23 02:54:44 -0400 |
commit | 1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16 (patch) | |
tree | 45384a867a888a66dcd0f0c890154fd2aba8ed87 /hw | |
parent | 7a0903f7ea8ac7e5b3191c9a2cfd1751b153f48c (diff) | |
download | qemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.zip qemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.tar.gz qemu-1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16.tar.bz2 |
vhost: release memory_listener object in error path
vhost_dev_start function does not release memory_listener object
in case of an error. This may crash the guest when vhost is unable
to set memory table:
stack trace of thread 125653:
Program terminated with signal SIGSEGV, Segmentation fault
#0 memory_listener_register (qemu-kvm + 0x6cda0f)
#1 vhost_dev_start (qemu-kvm + 0x699301)
#2 vhost_net_start (qemu-kvm + 0x45b03f)
#3 virtio_net_set_status (qemu-kvm + 0x665672)
#4 qmp_set_link (qemu-kvm + 0x548fd5)
#5 net_vhost_user_event (qemu-kvm + 0x552c45)
#6 tcp_chr_connect (qemu-kvm + 0x88d473)
#7 tcp_chr_new_client (qemu-kvm + 0x88cf83)
#8 tcp_chr_accept (qemu-kvm + 0x88b429)
#9 qio_net_listener_channel_func (qemu-kvm + 0x7ac07c)
#10 g_main_context_dispatch (libglib-2.0.so.0 + 0x54e2f)
Release memory_listener objects in the error path.
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20230529114333.31686-2-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Fixes: c471ad0e9b ("vhost_net: device IOTLB support")
Cc: qemu-stable@nongnu.org
Acked-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/virtio/vhost.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 7f3c727..7e1f556 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -2003,6 +2003,9 @@ fail_vq: } fail_mem: + if (vhost_dev_has_iommu(hdev)) { + memory_listener_unregister(&hdev->iommu_listener); + } fail_features: vdev->vhost_started = false; hdev->started = false; |