From nobody Mon Feb 9 00:42:40 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1504880901143647.4123854202163; Fri, 8 Sep 2017 07:28:21 -0700 (PDT) Received: from localhost ([::1]:45712 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dqKGZ-0006NR-Nc for importer@patchew.org; Fri, 08 Sep 2017 10:28:19 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50058) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dqKAa-0000kO-Hr for qemu-devel@nongnu.org; Fri, 08 Sep 2017 10:22:12 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dqKAW-0006ye-9S for qemu-devel@nongnu.org; Fri, 08 Sep 2017 10:22:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42588) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dqKAW-0006xq-3G; Fri, 08 Sep 2017 10:22:04 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4034480F95; Fri, 8 Sep 2017 14:22:03 +0000 (UTC) Received: from redhat.com (ovpn-120-144.rdu2.redhat.com [10.10.120.144]) by smtp.corp.redhat.com (Postfix) with SMTP id 03807627DF; Fri, 8 Sep 2017 14:21:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 4034480F95 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=mst@redhat.com Date: Fri, 8 Sep 2017 17:21:59 +0300 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1504880304-12069-2-git-send-email-mst@redhat.com> References: <1504880304-12069-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1504880304-12069-1-git-send-email-mst@redhat.com> X-Mutt-Fcc: =sent X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Fri, 08 Sep 2017 14:22:03 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 01/17] vhost: Release memory references on cleanup X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Alex Williamson , qemu-stable@nongnu.org, Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alex Williamson vhost registers a MemoryListener where it adds and removes references to MemoryRegions as the MemoryRegionSections pass through. The region_add callback is invoked for each existing section when the MemoryListener is registered, but unregistering the MemoryListener performs no reciprocal region_del callback. It's therefore the owner of the MemoryListener's responsibility to cleanup any persistent changes, such as these memory references, after unregistering. The consequence of this bug is that if we have both a vhost device and a vfio device, the vhost device will reference any mmap'd MMIO of the vfio device via this MemoryListener. If the vhost device is then removed, those references remain outstanding. If we then attempt to remove the vfio device, it never gets finalized and the only way to release the kernel file descriptors is to terminate the QEMU process. Fixes: dfde4e6e1a86 ("memory: add ref/unref calls") Cc: Michael S. Tsirkin Cc: Paolo Bonzini Cc: qemu-stable@nongnu.org # v1.6.0+ Signed-off-by: Alex Williamson Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/vhost.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 0049a2c..5fd69f0 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -1356,6 +1356,10 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) if (hdev->mem) { /* those are only safe after successful init */ memory_listener_unregister(&hdev->memory_listener); + for (i =3D 0; i < hdev->n_mem_sections; ++i) { + MemoryRegionSection *section =3D &hdev->mem_sections[i]; + memory_region_unref(section->mr); + } QLIST_REMOVE(hdev, entry); } if (hdev->migration_blocker) { --=20 MST