From nobody Fri May 9 00:15:14 2025
Delivered-To: importer@patchew.org
Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as
permitted sender) client-ip=209.51.188.17;
envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org;
helo=lists.gnu.org;
Authentication-Results: mx.zohomail.com;
dkim=fail;
spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted
sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
dmarc=fail(p=none dis=none) header.from=linaro.org
Return-Path: <qemu-devel-bounces+importer=patchew.org@nongnu.org>
Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by
mx.zohomail.com
with SMTPS id 1549038778347912.9361203655267;
Fri, 1 Feb 2019 08:32:58 -0800 (PST)
Received: from localhost ([127.0.0.1]:57601 helo=lists.gnu.org)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from <qemu-devel-bounces+importer=patchew.org@nongnu.org>)
id 1gpbkP-0003ya-AP
for importer@patchew.org; Fri, 01 Feb 2019 11:32:57 -0500
Received: from eggs.gnu.org ([209.51.188.92]:59012)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from <peter.maydell@linaro.org>) id 1gpbMD-0008Gg-OF
for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:08:05 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
(envelope-from <peter.maydell@linaro.org>) id 1gpbMA-0003j6-PN
for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:07:57 -0500
Received: from mail-wr1-x42d.google.com ([2a00:1450:4864:20::42d]:44169)
by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)
(Exim 4.71) (envelope-from <peter.maydell@linaro.org>)
id 1gpbMA-0003a4-CL
for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:07:54 -0500
Received: by mail-wr1-x42d.google.com with SMTP id z5so7630465wrt.11
for <qemu-devel@nongnu.org>; Fri, 01 Feb 2019 08:07:37 -0800 (PST)
Received: from orth.archaic.org.uk (orth.archaic.org.uk. [81.2.115.148])
by smtp.gmail.com with ESMTPSA id n6sm2847250wmk.9.2019.02.01.08.07.35
for <qemu-devel@nongnu.org>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 01 Feb 2019 08:07:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;
h=from:to:subject:date:message-id:in-reply-to:references:mime-version
:content-transfer-encoding;
bh=b9P1Xt5I5OJh/t+zJxdp8JNteub9Ra3hvV+vGC72MxQ=;
b=BbFTG+mXk1/vAMtJtfm5hJDdE+ygBeAc9VxZy1uRvrDPAFRjn+/ew1cOyutRuxev2c
zSeQ/q9cwNp7b27YH0bzboVeqwdMUtkOHn7VKaLZ6BgjqGBJzmsYIQzZ5+PQM4t3bq2e
VLE60am8Oiv5amN17irwK3JIVOHQEqm1Pd2Zs=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
:references:mime-version:content-transfer-encoding;
bh=b9P1Xt5I5OJh/t+zJxdp8JNteub9Ra3hvV+vGC72MxQ=;
b=TVoEyA09D2Dm1Q8RtMe9PEQAJBD2QpB96/DHMx5b0486Y4UeC5Utioi5VMnpHLyaJQ
aUI2C+/zGsM0uVcqy9gaT9F550SD2v8easN+4g96gxSRej6JbbztSfvx8UjF+uMjNrRJ
0ER1rP+ZTLQoT82rQhelMg+IBBSIHisoRbUUf/fd/fj1bQuoRAXyO9MtLv9G/74g+dzG
hEWDXLVxUxKR3nJaYCyVBDGq75ZIraFLZMe7TcHWTR+G2CN2dpssnZfwJ2/BovKBinEt
Kt9SLFxbJxU0uYBqvVSDOLnx5M1oc7trkjHJ4RejfMmXLAInnOXkKZ9BRr+zp9xJq1Yb
7S8A==
X-Gm-Message-State: AJcUukduP82bc9vobrYZuGdQlSreFFqMHVqGpjrj2gW8jnnhPWscim4b
uGZMpjgrvIdSfpZqxXXkBcKZ0dWtiCH2Zw==
X-Google-Smtp-Source:
ALg8bN4gMy1bNfD3Whf4vRX8FL5fjXc9J/RL94MOHfc7YCiF08IDvZYGYkM7raiHFWP1rEv9fTs+yQ==
X-Received: by 2002:a5d:6549:: with SMTP id z9mr38153439wrv.116.1549037256666;
Fri, 01 Feb 2019 08:07:36 -0800 (PST)
From: Peter Maydell <peter.maydell@linaro.org>
To: qemu-devel@nongnu.org
Date: Fri, 1 Feb 2019 16:06:38 +0000
Message-Id: <20190201160653.13829-33-peter.maydell@linaro.org>
X-Mailer: git-send-email 2.20.1
In-Reply-To: <20190201160653.13829-1-peter.maydell@linaro.org>
References: <20190201160653.13829-1-peter.maydell@linaro.org>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: Genre and OS details not
recognized.
X-Received-From: 2a00:1450:4864:20::42d
Subject: [Qemu-devel] [PULL 32/47] exec.c: Don't reallocate IOMMUNotifiers
that are in use
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.21
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org
Sender: "Qemu-devel" <qemu-devel-bounces+importer=patchew.org@nongnu.org>
X-ZohoMail-DKIM: fail (Header signature does not verify)
Content-Type: text/plain; charset="utf-8"
The tcg_register_iommu_notifier() code has a GArray of
TCGIOMMUNotifier structs which it has registered by passing
memory_region_register_iommu_notifier() a pointer to the embedded
IOMMUNotifier field. Unfortunately, if we need to enlarge the
array via g_array_set_size() this can cause a realloc(), which
invalidates the pointer that memory_region_register_iommu_notifier()
put into the MemoryRegion's iommu_notify list. This can result
in segfaults.
Switch the GArray to holding pointers to the TCGIOMMUNotifier
structs, so that we can individually allocate and free them.
Cc: qemu-stable@nongnu.org
Fixes: 1f871c5e6b0f30644a60a ("exec.c: Handle IOMMUs in address_space_trans=
late_for_iotlb()")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190128174241.5860-1-peter.maydell@linaro.org
---
exec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/exec.c b/exec.c
index da3e635f91b..25f3938a271 100644
--- a/exec.c
+++ b/exec.c
@@ -665,7 +665,7 @@ static void tcg_register_iommu_notifier(CPUState *cpu,
int i;
=20
for (i =3D 0; i < cpu->iommu_notifiers->len; i++) {
- notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier=
, i);
+ notifier =3D g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier =
*, i);
if (notifier->mr =3D=3D mr && notifier->iommu_idx =3D=3D iommu_idx=
) {
break;
}
@@ -673,7 +673,8 @@ static void tcg_register_iommu_notifier(CPUState *cpu,
if (i =3D=3D cpu->iommu_notifiers->len) {
/* Not found, add a new entry at the end of the array */
cpu->iommu_notifiers =3D g_array_set_size(cpu->iommu_notifiers, i =
+ 1);
- notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier=
, i);
+ notifier =3D g_new0(TCGIOMMUNotifier, 1);
+ g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i) =3D not=
ifier;
=20
notifier->mr =3D mr;
notifier->iommu_idx =3D iommu_idx;
@@ -705,8 +706,9 @@ static void tcg_iommu_free_notifier_list(CPUState *cpu)
TCGIOMMUNotifier *notifier;
=20
for (i =3D 0; i < cpu->iommu_notifiers->len; i++) {
- notifier =3D &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier=
, i);
+ notifier =3D g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier =
*, i);
memory_region_unregister_iommu_notifier(notifier->mr, ¬ifier->n=
);
+ g_free(notifier);
}
g_array_free(cpu->iommu_notifiers, true);
}
@@ -976,7 +978,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
}
=20
- cpu->iommu_notifiers =3D g_array_new(false, true, sizeof(TCGIOMMUNotif=
ier));
+ cpu->iommu_notifiers =3D g_array_new(false, true, sizeof(TCGIOMMUNotif=
ier *));
#endif
}
=20
--=20
2.20.1