From nobody Fri Nov 7 15:34:47 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1548697534949539.9372891186979; Mon, 28 Jan 2019 09:45:34 -0800 (PST) Received: from localhost ([127.0.0.1]:36009 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1goAyQ-0006do-VH for importer@patchew.org; Mon, 28 Jan 2019 12:45:30 -0500 Received: from eggs.gnu.org ([209.51.188.92]:32888) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1goAvn-0004hJ-PL for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1goAvm-0006Yd-SU for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:47 -0500 Received: from mail-wr1-x444.google.com ([2a00:1450:4864:20::444]:45016) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1goAvm-0006WK-Km for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:46 -0500 Received: by mail-wr1-x444.google.com with SMTP id z5so19013510wrt.11 for ; Mon, 28 Jan 2019 09:42:45 -0800 (PST) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [81.2.115.148]) by smtp.gmail.com with ESMTPSA id a12sm127767519wro.18.2019.01.28.09.42.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Jan 2019 09:42:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ut+xye7LMbCcrynN5ix96kyuLn+DHT6QmHWVyHDBmDc=; b=AStiOsCSIpLwctXwmkPAUvYgEXni1le4nWxP1wWaC2GjSaEVnn7wrct78vvNFB/Cud 5laItxTWFb9vaTJI4KjZ7bXJegfvXoZfunSh1rgrm9X4KTIldGLZt9VxB/YFwJjweiyv 7X0wJAhmuODAA7f67IjpncF09zg7huD/k2EcI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ut+xye7LMbCcrynN5ix96kyuLn+DHT6QmHWVyHDBmDc=; b=mrYArkszr3PbDQwsJS42pWKVd+mf8H2C2pGa0RfWBQUY/drlJI/FlkUXzLuVJawzPG TznDaafWgrk7nBz8u5vqt75kfKXhUXc7Jr3f8J44k7YYyaMt67zDGrSBjp1jDAT8ISrg uptmB9eYwXGLmc2GuBj+1xR9j4GroC14muFKiY5zlYYxECMUYU85phzv2cUYj+lKCGrZ ez9RgpDiMqavoseazi8NIR9nM/Ii0HYfs0a5vVv2/nco9GmqkSSiHhSWGFoJBmxTfJ4A vO6i11a/+L29KyDMhkzJDWHXODFlIt4ZPN9FaW6+/ThqTwGfVKkpK8eBBfBW3jFlwPlk sDRA== X-Gm-Message-State: AJcUukceK7PdOp9NEFIraPRdaK9t3nMizIDmtO8e/r+6cT6PeuRN9NPa MNS6clNQLsDe6SIQFvo0keI11pw6ZBD6dA== X-Google-Smtp-Source: ALg8bN6/FwzxmIDv9pYWc8G2FUF+h9gbDt7shDfaXjPMmlQ4yavcQlvDQ4wp1oBWloVuixcZ0oIfDg== X-Received: by 2002:a5d:524b:: with SMTP id p11mr21726995wrv.147.1548697363767; Mon, 28 Jan 2019 09:42:43 -0800 (PST) From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 28 Jan 2019 17:42:41 +0000 Message-Id: <20190128174241.5860-1-peter.maydell@linaro.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::444 Subject: [Qemu-devel] [PATCH] exec.c: Don't reallocate IOMMUNotifiers that are in use X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Richard Henderson , patches@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" The tcg_register_iommu_notifier() code has a GArray of TCGIOMMUNotifier structs which it has registered by passing memory_region_register_iommu_notifier() a pointer to the embedded IOMMUNotifier field. Unfortunately, if we need to enlarge the array via g_array_set_size() this can cause a realloc(), which invalidates the pointer that memory_region_register_iommu_notifier() put into the MemoryRegion's iommu_notify list. This can result in segfaults. Switch the GArray to holding pointers to the TCGIOMMUNotifier structs, so that we can individually allocate and free them. Cc: qemu-stable@nongnu.org Fixes: 1f871c5e6b0f30644a60a ("exec.c: Handle IOMMUs in address_space_trans= late_for_iotlb()") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson --- I don't know why I've suddenly started running into this; possibly it's because of a recent Ubuntu upgrade and so a newer glibc. --- exec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/exec.c b/exec.c index 895449f9261..cf6bc72c976 100644 --- a/exec.c +++ b/exec.c @@ -665,7 +665,7 @@ static void tcg_register_iommu_notifier(CPUState *cpu, int i; =20 for (i =3D 0; i < cpu->iommu_notifiers->len; i++) { - notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier= , i); + notifier =3D g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier = *, i); if (notifier->mr =3D=3D mr && notifier->iommu_idx =3D=3D iommu_idx= ) { break; } @@ -673,7 +673,8 @@ static void tcg_register_iommu_notifier(CPUState *cpu, if (i =3D=3D cpu->iommu_notifiers->len) { /* Not found, add a new entry at the end of the array */ cpu->iommu_notifiers =3D g_array_set_size(cpu->iommu_notifiers, i = + 1); - notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier= , i); + notifier =3D g_new0(TCGIOMMUNotifier, 1); + g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i) =3D not= ifier; =20 notifier->mr =3D mr; notifier->iommu_idx =3D iommu_idx; @@ -705,8 +706,9 @@ static void tcg_iommu_free_notifier_list(CPUState *cpu) TCGIOMMUNotifier *notifier; =20 for (i =3D 0; i < cpu->iommu_notifiers->len; i++) { - notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier= , i); + notifier =3D g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier = *, i); memory_region_unregister_iommu_notifier(notifier->mr, ¬ifier->n= ); + g_free(notifier); } g_array_free(cpu->iommu_notifiers, true); } @@ -976,7 +978,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp) vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu); } =20 - cpu->iommu_notifiers =3D g_array_new(false, true, sizeof(TCGIOMMUNotif= ier)); + cpu->iommu_notifiers =3D g_array_new(false, true, sizeof(TCGIOMMUNotif= ier *)); #endif } =20 --=20 2.20.1