The following changes since commit 33f18cf7dca7741d3647d514040904ce83edd73d:

Merge remote-tracking branch 'remotes/kraxel/tags/audio-20190821-pull-request' into staging (2019-08-21 15:18:50 +0100)

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 5d4c1ed3d46d7e2010b389fe5f3376f605182ab0:

vhost-user-scsi: prevent using uninitialized vqs (2019-08-22 16:52:23 +0100)

Raphael Norwitz (1):

vhost-user-scsi: prevent using uninitialized vqs

Stefan Hajnoczi (1):

util/async: hold AioContext ref to prevent use-after-free

hw/scsi/vhost-user-scsi.c | 2 +-

util/async.c | 8 ++++++++

2 files changed, 9 insertions(+), 1 deletion(-)

2.21.0

The tests/test-bdrv-drain /bdrv-drain/iothread/drain test case does the

following:

1. The preadv coroutine calls aio_bh_schedule_oneshot() and then yields.

2. The one-shot BH executes in another AioContext. All it does is call

aio_co_wakeup(preadv_co).

3. The preadv coroutine is re-entered and returns.

There is a race condition in aio_co_wake() where the preadv coroutine

returns and the test case destroys the preadv IOThread. aio_co_wake()

can still be running in the other AioContext and it performs an access

to the freed IOThread AioContext.

Here is the race in aio_co_schedule():

QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,

co, co_scheduled_next);

<-- race: co may execute before we invoke qemu_bh_schedule()!

qemu_bh_schedule(ctx->co_schedule_bh);

So if co causes ctx to be freed then we're in trouble. Fix this problem

by holding a reference to ctx.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20190723190623.21537-1-stefanha@redhat.com

Message-Id: <20190723190623.21537-1-stefanha@redhat.com>

util/async.c | 8 ++++++++

1 file changed, 8 insertions(+)

diff --git a/util/async.c b/util/async.c

--- a/util/async.c

+++ b/util/async.c

@@ -XXX,XX +XXX,XX @@ void aio_co_schedule(AioContext *ctx, Coroutine *co)

abort();

}

+ /* The coroutine might run and release the last ctx reference before we

+ * invoke qemu_bh_schedule(). Take a reference to keep ctx alive until

+ * we're done.

+ */

+ aio_context_ref(ctx);

+

QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,

co, co_scheduled_next);

qemu_bh_schedule(ctx->co_schedule_bh);

+

+ aio_context_unref(ctx);

}

void aio_co_wake(struct Coroutine *co)

2.21.0

From: Raphael Norwitz <raphael.norwitz@nutanix.com>

Of the 3 virtqueues, seabios only sets cmd, leaving ctrl

and event without a physical address. This can cause

vhost_verify_ring_part_mapping to return ENOMEM, causing

the following logs:

qemu-system-x86_64: Unable to map available ring for ring 0

qemu-system-x86_64: Verify ring failure on region 0

The qemu commit e6cc11d64fc998c11a4dfcde8fda3fc33a74d844

has already resolved the issue for vhost scsi devices but

the fix was never applied to vhost-user scsi devices.

Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Message-id: 1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com

Message-Id: <1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com>

hw/scsi/vhost-user-scsi.c | 2 +-

diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c

--- a/hw/scsi/vhost-user-scsi.c

+++ b/hw/scsi/vhost-user-scsi.c

@@ -XXX,XX +XXX,XX @@ static void vhost_user_scsi_realize(DeviceState *dev, Error **errp)

}

vsc->dev.nvqs = 2 + vs->conf.num_queues;

- vsc->dev.vqs = g_new(struct vhost_virtqueue, vsc->dev.nvqs);

+ vsc->dev.vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs);

vsc->dev.vq_index = 0;

vsc->dev.backend_features = 0;

vqs = vsc->dev.vqs;

2.21.0