From nobody Tue Feb 10 17:34:56 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177006660355324.032015052266388; Mon, 2 Feb 2026 13:10:03 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vn11K-0004VV-5D; Mon, 02 Feb 2026 15:59:42 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vn111-00047J-CZ; Mon, 02 Feb 2026 15:59:24 -0500 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vn10y-0003pA-NS; Mon, 02 Feb 2026 15:59:23 -0500 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 61681185195; Mon, 02 Feb 2026 23:57:52 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2A19735B30C; Mon, 02 Feb 2026 23:58:34 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Thomas Huth , Stefan Hajnoczi , Michael Tokarev Subject: [Stable-10.1.4 09/74] block: Fix BDS use after free during shutdown Date: Mon, 2 Feb 2026 23:57:20 +0300 Message-ID: <20260202205833.941615-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1770066603861158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf During shutdown, blockdev_close_all_bdrv_states() drops any block node references that are still owned by the monitor (i.e. the user). However, in doing so, it forgot to also remove the node from monitor_bdrv_states (which qmp_blockdev_del() correctly does), which means that later calls of bdrv_first()/bdrv_next() will still return the (now stale) pointer to the node. Usually there is no such call after this point, but in some cases it can happen. In the reported case, there was an ongoing migration, and the migration thread wasn't shut down yet: migration_shutdown() called by qemu_cleanup() doesn't actually wait for the migration to be shut down, but may just move it to MIGRATION_STATUS_CANCELLING. The next time migration_iteration_finish() runs, it sees the status and tries to re-activate all block devices that migration may have previously inactivated. This is where bdrv_first()/bdrv_next() get called and the access to the already freed node happens. It is debatable if migration_shutdown() should really return before migration has settled, but leaving a dangling pointer in the list of monitor-owned block nodes is clearly a bug either way and fixing it solves the immediate problem, so fix it. Cc: qemu-stable@nongnu.org Reported-by: Thomas Huth Signed-off-by: Kevin Wolf Message-ID: <20251215150714.130214-1-kwolf@redhat.com> Reviewed-by: Thomas Huth Tested-by: Thomas Huth Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf (cherry picked from commit 307bc43095b8ab1765fd66c26003d5da06681c05) Signed-off-by: Michael Tokarev diff --git a/blockdev.c b/blockdev.c index b451fee6e1..76c8dd0573 100644 --- a/blockdev.c +++ b/blockdev.c @@ -685,6 +685,7 @@ void blockdev_close_all_bdrv_states(void) =20 GLOBAL_STATE_CODE(); QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) { + QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list); bdrv_unref(bs); } } --=20 2.47.3