[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 66/97] vfio-helpers: Fix qemu_vfio_open_pci() crash
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 66/97] vfio-helpers: Fix qemu_vfio_open_pci() crash |
Date: |
Mon, 1 Apr 2019 15:59:40 -0500 |
From: Markus Armbruster <address@hidden>
qemu_vfio_open_common() initializes s->lock only after passing s to
qemu_vfio_dma_map() via qemu_vfio_init_ramblock().
qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes.
Fix by initializing s->lock first.
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1645840
Fixes: 418026ca43bc2626db092d7558258f9594366f28
Cc: address@hidden
Signed-off-by: Markus Armbruster <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 549b50a31d28f2687a47e827a1e17300784a2c44)
Signed-off-by: Michael Roth <address@hidden>
---
util/vfio-helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
index 1d9272efa4..cccc9cd42e 100644
--- a/util/vfio-helpers.c
+++ b/util/vfio-helpers.c
@@ -411,13 +411,13 @@ static int qemu_vfio_init_ramblock(const char
*block_name, void *host_addr,
static void qemu_vfio_open_common(QEMUVFIOState *s)
{
+ qemu_mutex_init(&s->lock);
s->ram_notifier.ram_block_added = qemu_vfio_ram_block_added;
s->ram_notifier.ram_block_removed = qemu_vfio_ram_block_removed;
ram_block_notifier_add(&s->ram_notifier);
s->low_water_mark = QEMU_VFIO_IOVA_MIN;
s->high_water_mark = QEMU_VFIO_IOVA_MAX;
qemu_ram_foreach_block(qemu_vfio_init_ramblock, s);
- qemu_mutex_init(&s->lock);
}
/**
--
2.17.1
- [Qemu-devel] [PATCH 47/97] pcnet: fix possible buffer overflow, (continued)
- [Qemu-devel] [PATCH 47/97] pcnet: fix possible buffer overflow, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 52/97] target/arm: Correct condition for v8M callee stack push, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 46/97] rtl8139: fix possible out of bound access, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 53/97] nbd/server: fix NBD_CMD_CACHE, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 54/97] intel_iommu: introduce vtd_reset_caches(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 56/97] nbd: fix NBD_FLAG_SEND_CACHE value, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 57/97] migration: Stop postcopy fault thread before notifying, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 55/97] intel_iommu: better handling of dmar state switch, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 61/97] net: drop too large packet early, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 65/97] fmops: fix off-by-one in AR_TABLE and DR_TABLE array size, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 66/97] vfio-helpers: Fix qemu_vfio_open_pci() crash,
Michael Roth <=
- [Qemu-devel] [PATCH 67/97] i2c: Move typedef of bitbang_i2c_interface to i2c.h, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 70/97] nbd/client: Make x-dirty-bitmap more reliable, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 72/97] mirror: fix dead-lock, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 73/97] iotests: simple mirror test with kvm on 1G image, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 68/97] i2c: Add a length check to the SMBus write handling, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 78/97] hw/s390x: Fix bad mask in time2tod(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 35/97] block: Fix use after free error in bdrv_open_inherit(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 84/97] tpm: use loop iterator to set sts data field, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 92/97] bitmap: Update count after a merge, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 06/97] target/arm: Fix sign-extension in sve do_ldr/do_str, Michael Roth, 2019/04/01