[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 82/97] exec.c: Don't reallocate IOMMUNotifiers that
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 82/97] exec.c: Don't reallocate IOMMUNotifiers that are in use |
Date: |
Mon, 1 Apr 2019 15:59:56 -0500 |
From: Peter Maydell <address@hidden>
The tcg_register_iommu_notifier() code has a GArray of
TCGIOMMUNotifier structs which it has registered by passing
memory_region_register_iommu_notifier() a pointer to the embedded
IOMMUNotifier field. Unfortunately, if we need to enlarge the
array via g_array_set_size() this can cause a realloc(), which
invalidates the pointer that memory_region_register_iommu_notifier()
put into the MemoryRegion's iommu_notify list. This can result
in segfaults.
Switch the GArray to holding pointers to the TCGIOMMUNotifier
structs, so that we can individually allocate and free them.
Cc: address@hidden
Fixes: 1f871c5e6b0f30644a60a ("exec.c: Handle IOMMUs in
address_space_translate_for_iotlb()")
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden
(cherry picked from commit 5601be3b01d73e21c09331599e2ce62df016ff94)
Signed-off-by: Michael Roth <address@hidden>
---
exec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/exec.c b/exec.c
index 4f5df07b6a..9bafcb155a 100644
--- a/exec.c
+++ b/exec.c
@@ -690,7 +690,7 @@ static void tcg_register_iommu_notifier(CPUState *cpu,
int i;
for (i = 0; i < cpu->iommu_notifiers->len; i++) {
- notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i);
+ notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i);
if (notifier->mr == mr && notifier->iommu_idx == iommu_idx) {
break;
}
@@ -698,7 +698,8 @@ static void tcg_register_iommu_notifier(CPUState *cpu,
if (i == cpu->iommu_notifiers->len) {
/* Not found, add a new entry at the end of the array */
cpu->iommu_notifiers = g_array_set_size(cpu->iommu_notifiers, i + 1);
- notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i);
+ notifier = g_new0(TCGIOMMUNotifier, 1);
+ g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i) = notifier;
notifier->mr = mr;
notifier->iommu_idx = iommu_idx;
@@ -730,8 +731,9 @@ static void tcg_iommu_free_notifier_list(CPUState *cpu)
TCGIOMMUNotifier *notifier;
for (i = 0; i < cpu->iommu_notifiers->len; i++) {
- notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i);
+ notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i);
memory_region_unregister_iommu_notifier(notifier->mr, ¬ifier->n);
+ g_free(notifier);
}
g_array_free(cpu->iommu_notifiers, true);
}
@@ -1000,7 +1002,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
}
- cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier));
+ cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier
*));
#endif
}
--
2.17.1
- [Qemu-devel] [PATCH 68/97] i2c: Add a length check to the SMBus write handling, (continued)
- [Qemu-devel] [PATCH 68/97] i2c: Add a length check to the SMBus write handling, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 78/97] hw/s390x: Fix bad mask in time2tod(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 35/97] block: Fix use after free error in bdrv_open_inherit(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 84/97] tpm: use loop iterator to set sts data field, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 92/97] bitmap: Update count after a merge, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 06/97] target/arm: Fix sign-extension in sve do_ldr/do_str, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 96/97] usb-mtp: outlaw slashes in filenames, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 95/97] 9p: fix QEMU crash when renaming files, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 97/97] usb-mtp: use O_NOFOLLOW and O_CLOEXEC., Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 89/97] hw/rdma: another clang compilation fix, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 82/97] exec.c: Don't reallocate IOMMUNotifiers that are in use,
Michael Roth <=
- [Qemu-devel] [PATCH 87/97] block: Fix invalidate_cache error path for parent activation, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 51/97] block-backend: Set werror/rerror defaults in blk_new(), Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 85/97] tpm: Make sure new locality passed to tpm_tis_prep_abort() is valid, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 03/97] target/arm: Reorganize SVE WHILE, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 23/97] monitor: fix oob command leak, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 07/97] target/arm: Fix offset for LD1R instructions, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 33/97] pc: acpi: revert back to 1 SRAT entry for hotpluggable area, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 30/97] kvm: add call to qemu_add_opts() for -overcommit option, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 21/97] aio-posix: Don't count ctx->notifier as progress when polling, Michael Roth, 2019/04/01
- [Qemu-devel] [PATCH 49/97] virt: Suppress external aborts on virt-2.10 and earlier, Michael Roth, 2019/04/01