| From a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 Sep 17 00:00:00 2001 |
| From: Ani Sinha <anisinha@redhat.com> |
| Date: Wed, 2 Aug 2023 09:25:27 +0000 |
| Subject: [PATCH] vhost-vdpa: do not cleanup the vdpa/vhost-net structures if |
| peer nic is present |
| |
| When a peer nic is still attached to the vdpa backend, it is too early to free |
| up the vhost-net and vdpa structures. If these structures are freed here, then |
| QEMU crashes when the guest is being shut down. The following call chain |
| would result in an assertion failure since the pointer returned from |
| vhost_vdpa_get_vhost_net() would be NULL: |
| |
| do_vm_stop() -> vm_state_notify() -> virtio_set_status() -> |
| virtio_net_vhost_status() -> get_vhost_net(). |
| |
| Therefore, we defer freeing up the structures until at guest shutdown |
| time when qemu_cleanup() calls net_cleanup() which then calls |
| qemu_del_net_client() which would eventually call vhost_vdpa_cleanup() |
| again to free up the structures. This time, the loop in net_cleanup() |
| ensures that vhost_vdpa_cleanup() will be called one last time when |
| all the peer nics are detached and freed. |
| |
| All unit tests pass with this change. |
| |
| CC: imammedo@redhat.com |
| CC: jusual@redhat.com |
| CC: mst@redhat.com |
| Fixes: CVE-2023-3301 |
| Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929 |
| Signed-off-by: Ani Sinha <anisinha@redhat.com> |
| Message-Id: <20230619065209.442185-1-anisinha@redhat.com> |
| Reviewed-by: Michael S. Tsirkin <mst@redhat.com> |
| Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
| |
| CVE: CVE-2023-3301 |
| |
| Upstream-Status: Backport [https://github.com/qemu/qemu/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8] |
| |
| Signed-off-by: Yogita Urade <yogita.urade@windriver.com> |
| --- |
| net/vhost-vdpa.c | 9 +++++++++ |
| 1 file changed, 9 insertions(+) |
| |
| diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c |
| index 2b4b85d8f..8dbe929c1 100644 |
| --- a/net/vhost-vdpa.c |
| +++ b/net/vhost-vdpa.c |
| @@ -158,6 +158,15 @@ err_init: |
| static void vhost_vdpa_cleanup(NetClientState *nc) |
| { |
| VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc); |
| + |
| + /* |
| + * If a peer NIC is attached, do not cleanup anything. |
| + * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup() |
| + * when the guest is shutting down. |
| + */ |
| + if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) { |
| + return; |
| + } |
| struct vhost_dev *dev = &s->vhost_net->dev; |
| |
| qemu_vfree(s->cvq_cmd_out_buffer); |
| -- |
| 2.40.0 |