1. Patchew
  2. QEMU
  3. View series

[PATCH] virtio-mmio: fix guest kernel crash with SHM regions

Laurent Vivier posted 1 patch 4 years, 11 months ago
Test checkpatch passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20201220163539.2255963-1-laurent@vivier.eu
Maintainers: "Michael S. Tsirkin" <mst@redhat.com>
hw/virtio/virtio-mmio.c | 8 ++++++++
1 file changed, 8 insertions(+)
[PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Posted by Laurent Vivier 4 years, 11 months ago 
In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
since
commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
get the address and the length of the region.

commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"

As this is not implemented in QEMU, address and length are 0 and passed
as is to devm_request_mem_region() that triggers a crash:

  [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
  Unable to handle kernel NULL pointer dereference at virtual address (ptrval)

According to the comments in the kernel, a non existent shared region
has a length of (u64)-1.

This is what we return now with this patch to disable the region.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/virtio/virtio-mmio.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index e1b5c3b81e37..610661d6a526 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
             return 0;
         }
         return vdev->generation;
+   case VIRTIO_MMIO_SHM_LEN_LOW:
+   case VIRTIO_MMIO_SHM_LEN_HIGH:
+        /*
+         * VIRTIO_MMIO_SHM_SEL is unimplemented
+         * according to the linux driver, if region length is -1
+         * the shared memory doesn't exist
+         */
+        return -1;
     case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
     case VIRTIO_MMIO_DRIVER_FEATURES:
     case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
-- 
2.29.2
Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Posted by Stefano Garzarella 4 years, 11 months ago 
On Sun, Dec 20, 2020 at 05:35:39PM +0100, Laurent Vivier wrote:
>In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
>since
>commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
>but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
>get the address and the length of the region.
>
>commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
>
>As this is not implemented in QEMU, address and length are 0 and passed
>as is to devm_request_mem_region() that triggers a crash:
>
>  [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
>  Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
>
>According to the comments in the kernel, a non existent shared region
>has a length of (u64)-1.
>
>This is what we return now with this patch to disable the region.
>
>Signed-off-by: Laurent Vivier <laurent@vivier.eu>
>---
> hw/virtio/virtio-mmio.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
>index e1b5c3b81e37..610661d6a526 100644
>--- a/hw/virtio/virtio-mmio.c
>+++ b/hw/virtio/virtio-mmio.c
>@@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
>             return 0;
>         }
>         return vdev->generation;
>+   case VIRTIO_MMIO_SHM_LEN_LOW:
>+   case VIRTIO_MMIO_SHM_LEN_HIGH:
>+        /*
>+         * VIRTIO_MMIO_SHM_SEL is unimplemented
>+         * according to the linux driver, if region length is -1
>+         * the shared memory doesn't exist
>+         */
>+        return -1;
>     case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
>     case VIRTIO_MMIO_DRIVER_FEATURES:
>     case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>-- 
>2.29.2
>
>

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Posted by Laurent Vivier 4 years, 10 months ago 
Anyone to merge this?

Thanks,
Laurent

Le 20/12/2020 à 17:35, Laurent Vivier a écrit :
> In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
> since
> commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
> but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
> get the address and the length of the region.
> 
> commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
> 
> As this is not implemented in QEMU, address and length are 0 and passed
> as is to devm_request_mem_region() that triggers a crash:
> 
>   [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
>   Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
> 
> According to the comments in the kernel, a non existent shared region
> has a length of (u64)-1.
> 
> This is what we return now with this patch to disable the region.
> 
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> ---
>  hw/virtio/virtio-mmio.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
> index e1b5c3b81e37..610661d6a526 100644
> --- a/hw/virtio/virtio-mmio.c
> +++ b/hw/virtio/virtio-mmio.c
> @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
>              return 0;
>          }
>          return vdev->generation;
> +   case VIRTIO_MMIO_SHM_LEN_LOW:
> +   case VIRTIO_MMIO_SHM_LEN_HIGH:
> +        /*
> +         * VIRTIO_MMIO_SHM_SEL is unimplemented
> +         * according to the linux driver, if region length is -1
> +         * the shared memory doesn't exist
> +         */
> +        return -1;
>      case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
>      case VIRTIO_MMIO_DRIVER_FEATURES:
>      case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>
Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Posted by Laurent Vivier 4 years, 11 months ago 
Hi,

any comment?

Thanks,
Laurent

Le 20/12/2020 à 17:35, Laurent Vivier a écrit :
> In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
> since
> commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
> but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
> get the address and the length of the region.
> 
> commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
> 
> As this is not implemented in QEMU, address and length are 0 and passed
> as is to devm_request_mem_region() that triggers a crash:
> 
>   [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
>   Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
> 
> According to the comments in the kernel, a non existent shared region
> has a length of (u64)-1.
> 
> This is what we return now with this patch to disable the region.
> 
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> ---
>  hw/virtio/virtio-mmio.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
> index e1b5c3b81e37..610661d6a526 100644
> --- a/hw/virtio/virtio-mmio.c
> +++ b/hw/virtio/virtio-mmio.c
> @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
>              return 0;
>          }
>          return vdev->generation;
> +   case VIRTIO_MMIO_SHM_LEN_LOW:
> +   case VIRTIO_MMIO_SHM_LEN_HIGH:
> +        /*
> +         * VIRTIO_MMIO_SHM_SEL is unimplemented
> +         * according to the linux driver, if region length is -1
> +         * the shared memory doesn't exist
> +         */
> +        return -1;
>      case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
>      case VIRTIO_MMIO_DRIVER_FEATURES:
>      case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>
Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Posted by Gerd Hoffmann 4 years, 11 months ago 
  Hi,

> > According to the comments in the kernel, a non existent shared region
> > has a length of (u64)-1.

virtio spec says the same.

> > +   case VIRTIO_MMIO_SHM_LEN_LOW:
> > +   case VIRTIO_MMIO_SHM_LEN_HIGH:
> > +        /*
> > +         * VIRTIO_MMIO_SHM_SEL is unimplemented
> > +         * according to the linux driver, if region length is -1
> > +         * the shared memory doesn't exist
> > +         */
> > +        return -1;

Acked-by: Gerd Hoffmann <kraxel@redhat.com>

take care,
  Gerd

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.