Emulation/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-06-02 12:08:06 -04:00
Code Issues Packages Projects Releases Wiki Activity
xemu/hw
History
Prasad Pandit f3b7f02c3b vhost: release memory_listener object in error path 
vhost_dev_start function does not release memory_listener object
in case of an error. This may crash the guest when vhost is unable
to set memory table:

  stack trace of thread 125653:
  Program terminated with signal SIGSEGV, Segmentation fault
  #0  memory_listener_register (qemu-kvm + 0x6cda0f)
  #1  vhost_dev_start (qemu-kvm + 0x699301)
  #2  vhost_net_start (qemu-kvm + 0x45b03f)
  #3  virtio_net_set_status (qemu-kvm + 0x665672)
  #4  qmp_set_link (qemu-kvm + 0x548fd5)
  #5  net_vhost_user_event (qemu-kvm + 0x552c45)
  #6  tcp_chr_connect (qemu-kvm + 0x88d473)
  #7  tcp_chr_new_client (qemu-kvm + 0x88cf83)
  #8  tcp_chr_accept (qemu-kvm + 0x88b429)
  #9  qio_net_listener_channel_func (qemu-kvm + 0x7ac07c)
  #10 g_main_context_dispatch (libglib-2.0.so.0 + 0x54e2f)

Release memory_listener objects in the error path.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20230529114333.31686-2-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Fixes: c471ad0e9b ("vhost_net: device IOTLB support")
Cc: qemu-stable@nongnu.org
Acked-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-26 19:35:39 +03:00
..
9pfs 9pfs: prevent opening special files (CVE-2023-2861) 2023-06-08 23:52:29 +03:00
acpi acpi: pcihp: allow repeating hot-unplug requests 2023-05-18 21:09:41 +03:00
adc hw/adc: Make adci[*] R/W in NPCM7XX ADC 2022-07-18 13:20:14 +01:00
alpha hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
arm hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number 2023-05-31 09:43:56 +03:00
audio hw/audio/intel-hda: Drop unnecessary prototype 2022-11-23 12:30:45 +01:00
avr Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
block hw/virtio: generalise CHR_EVENT_CLOSED handling 2022-12-01 02:30:13 -05:00
char Drop useless casts from g_malloc() & friends to pointer 2022-10-22 23:15:40 +02:00
core machine: do not crash if default RAM backend name has been stolen 2023-05-28 12:02:26 +03:00
cpu
cris
cxl hw/cxl/cdat: CXL CDAT Data Object Exchange implementation 2022-11-07 13:12:19 -05:00
display hw/display/next-fb: Fix comment typo 2022-12-03 22:07:07 +01:00
dma hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop. 2023-05-31 09:43:56 +03:00
gpio hw/gpio/meson: Introduce dedicated config switch for hw/gpio/mpc8xxx 2022-10-17 16:15:09 -03:00
hppa target/hppa: Provide qemu version via fw_cfg to firmware 2023-06-26 19:35:29 +03:00
hyperv hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset() 2022-10-27 10:27:23 +01:00
i2c hw/i2c/aspeed: Fix old reg slave receive 2022-10-24 11:20:15 +02:00
i386 xen/pt: reserve PCI slot 2 for Intel igd-passthru 2023-05-18 21:09:59 +03:00
ide hw/ppc/mac.h: Rename to include/hw/nvram/mac_nvram.h 2022-10-31 18:48:23 +00:00
input pckbd: remove legacy i8042_mm_init() function 2022-07-18 19:28:46 +01:00
intc hw/intc/allwinner-a10-pic: Handle IRQ levels other than 0 or 1 2023-06-22 10:38:09 +03:00
ipack
ipmi ipmi:smbus: Add a check around a memcpy 2022-08-01 06:40:50 -05:00
isa acpi: x86: move RPQx field back to _SB scope 2022-11-22 05:19:00 -05:00
loongarch Revert "hw/loongarch/virt: Add cfi01 pflash device" 2022-12-05 11:24:35 -05:00
m68k m68k/q800: do not re-randomize RNG seed on snapshot load 2022-10-27 11:34:31 +01:00
mem hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange 2022-11-07 13:12:19 -05:00
microblaze hw/microblaze: pass random seed to fdt 2022-09-21 19:59:56 +02:00
mips hw/mips/malta: Use bootloader helper to set BAR registers 2022-10-31 11:32:56 +01:00
misc aspeed/hace: Initialize g_autofree pointer 2023-06-16 16:15:56 +03:00
net rtl8139: fix large_send_mss divide-by-zero 2023-05-28 12:02:26 +03:00
nios2 hw/nios2: set machine->fdt in nios2_load_dtb() 2022-10-17 16:15:10 -03:00
nubus
nvme hw/nvme: fix memory leak in nvme_dsm 2023-04-13 18:28:32 +03:00
nvram Revert "x86: return modified setup_data only if read as memory, not as file" 2023-03-29 10:20:04 +03:00
openrisc openrisc: re-randomize rng-seed on reboot 2022-10-27 11:34:31 +01:00
pci msix: Assert that specified vector is in range 2022-11-07 14:08:17 -05:00
pci-bridge hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE 2022-11-07 13:12:19 -05:00
pci-host hw/pci-host/pnv_phb: Avoid quitting QEMU if hotplug of pnv-phb-root-port fails 2022-11-10 18:22:10 -03:00
pcmcia
ppc hw/ppc/prep: Fix wiring of PIC -> CPU interrupt 2023-05-31 09:43:56 +03:00
rdma hw/pvrdma: Protect against buggy or malicious guest driver 2023-03-30 12:19:04 +03:00
remote hw/remote: Fix vfu_cfg trace offset format 2023-06-11 11:02:28 +03:00
riscv hw/riscv: qemu crash when NUMA nodes exceed available CPUs 2023-06-14 13:02:36 +03:00
rtc goldfish_rtc: Add big-endian property 2022-09-04 07:02:56 +01:00
rx rx: re-randomize rng-seed on reboot 2022-10-27 11:34:31 +01:00
s390x s390x: Fix spelling errors 2022-11-16 10:15:26 +01:00
scsi hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) 2023-05-28 12:02:26 +03:00
sd hw/sd/allwinner-sdhost: Correctly byteswap descriptor fields 2023-05-18 21:09:59 +03:00
sensor hw/sensor: Add Renesas ISL69259 device model 2022-07-14 16:24:38 +02:00
sh4 Use g_new() & friends where that makes obvious sense 2022-03-21 15:44:44 +01:00
smbios hw/smbios: fix field corruption in type 4 table 2023-03-29 10:20:04 +03:00
sparc machine: make memory-backend a link property 2022-05-12 12:29:44 +02:00
sparc64 hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
ssi aspeed/smc: Cache AspeedSMCClass 2022-10-24 11:20:15 +02:00
timer hw/timer/nrf51_timer: Don't lose time when timer is queried in tight loop 2023-06-22 10:38:38 +03:00
tpm tpm_crb: Avoid backend startup just before shutdown under Xen 2022-09-09 17:55:59 -04:00
tricore
usb usb/ohci: Set pad to 0 after frame update 2023-05-28 12:02:26 +03:00
vfio pci,pc,virtio: features, tests, fixes, cleanups 2022-11-07 18:43:56 -05:00
virtio vhost: release memory_listener object in error path 2023-06-26 19:35:39 +03:00
watchdog watchdog: remove -watchdog option 2022-09-29 11:40:28 +02:00
xen xen/pt: reserve PCI slot 2 for Intel igd-passthru 2023-05-18 21:09:59 +03:00
xenpv Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
xtensa hw/xtensa: fix reset value of MIROUT register of MX PIC 2022-05-06 15:27:40 -07:00
Kconfig hw/loongarch: Add support loongson3 virt machine type. 2022-06-06 18:09:03 +00:00
meson.build hw/loongarch: Add support loongson3 virt machine type. 2022-06-06 18:09:03 +00:00