These functions wrap ioctl().  When ioctl() fails, it sets @errno.
The wrappers then return that @errno negated.

Except they call accel_ioctl_end() between calling ioctl() and reading
@errno.  accel_ioctl_end() can clobber @errno, e.g. when a futex()
system call fails.  Seems unlikely, but it's a bug all the same.

Fix by retrieving @errno before calling accel_ioctl_end().

Fixes: a27dd2de68f3 (KVM: keep track of running ioctls)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f9254ae654..28006d73c5 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3373,10 +3373,10 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...)
     trace_kvm_vm_ioctl(type, arg);
     accel_ioctl_begin();
     ret = ioctl(s->vmfd, type, arg);
-    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
+    accel_ioctl_end();
     return ret;
 }
 
@@ -3413,10 +3413,10 @@ int kvm_device_ioctl(int fd, unsigned long type, ...)
     trace_kvm_device_ioctl(fd, type, arg);
     accel_ioctl_begin();
     ret = ioctl(fd, type, arg);
-    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
+    accel_ioctl_end();
     return ret;
 }
 
-- 
2.49.0

On 11/28/25 18:20, Markus Armbruster wrote:
> These functions wrap ioctl().  When ioctl() fails, it sets @errno.
> The wrappers then return that @errno negated.
> 
> Except they call accel_ioctl_end() between calling ioctl() and reading
> @errno.  accel_ioctl_end() can clobber @errno, e.g. when a futex()
> system call fails.  Seems unlikely, but it's a bug all the same.
> 
> Fix by retrieving @errno before calling accel_ioctl_end().
> 
> Fixes: a27dd2de68f3 (KVM: keep track of running ioctls)
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Isn't this a qemu-stable material?

Thanks,

/mjt

Michael Tokarev <mjt@tls.msk.ru> writes:

> On 11/28/25 18:20, Markus Armbruster wrote:
>> These functions wrap ioctl().  When ioctl() fails, it sets @errno.
>> The wrappers then return that @errno negated.
>>
>> Except they call accel_ioctl_end() between calling ioctl() and reading
>> @errno.  accel_ioctl_end() can clobber @errno, e.g. when a futex()
>> system call fails.  Seems unlikely, but it's a bug all the same.
>>
>> Fix by retrieving @errno before calling accel_ioctl_end().
>>
>> Fixes: a27dd2de68f3 (KVM: keep track of running ioctls)
>> Signed-off-by: Markus Armbruster <armbru@redhat.com>
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>
> Isn't this a qemu-stable material?

I think it is.  I should've thought of adding Cc: qemu-stable.  My
apologies!

Markus Armbruster <armbru@redhat.com> writes:

> These functions wrap ioctl().  When ioctl() fails, it sets @errno.
> The wrappers then return that @errno negated.
>
> Except they call accel_ioctl_end() between calling ioctl() and reading
> @errno.  accel_ioctl_end() can clobber @errno, e.g. when a futex()
> system call fails.  Seems unlikely, but it's a bug all the same.
>
> Fix by retrieving @errno before calling accel_ioctl_end().
>
> Fixes: a27dd2de68f3 (KVM: keep track of running ioctls)
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Queued for 10.2.