Skip to content

Commit

Permalink
kvm: Fix crash due to access uninitialized kvm_state
Browse files Browse the repository at this point in the history
Runs into core dump on arm64 and the backtrace extracted from the
core dump is shown as below. It's caused by accessing uninitialized
@kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073
("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
memory region is added earlier than before.

    main
    qemu_init
    configure_accelerators
    qemu_opts_foreach
    do_configure_accelerator
    accel_init_machine
    kvm_init
    virt_kvm_type
    virt_set_memmap
    machine_memory_devices_init
    memory_region_add_subregion
    memory_region_add_subregion_common
    memory_region_update_container_subregions
    memory_region_transaction_begin
    qemu_flush_coalesced_mmio_buffer
    kvm_flush_coalesced_mmio_buffer

Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
uninitialized @kvm_state. With this applied, no crash is observed on
arm64.

Fixes: 176d073 ("hw/arm/virt: Use machine_memory_devices_init()")
Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230731125946.2038742-1-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
  • Loading branch information
Gavin Shan authored and pm215 committed Jul 31, 2023
1 parent 71054f7 commit fe6bda5
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion accel/kvm/kvm-all.c
Original file line number Diff line number Diff line change
Expand Up @@ -2812,7 +2812,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
{
KVMState *s = kvm_state;

if (s->coalesced_flush_in_progress) {
if (!s || s->coalesced_flush_in_progress) {
return;
}

Expand Down

0 comments on commit fe6bda5

Please sign in to comment.