From nobody Tue Apr 7 21:44:29 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241940; cv=none; d=zohomail.com; s=zohoarc; b=BUSpZ5qR8V5csFulK23u5EZIJPgayEFC6jMwo2LkJi/Ncf48GZskZ6QS44CWZFG21oG5Wieoz2ZVgy5p04SbeMZ9MCuwXBs0t2D/NcFxxDMPnavpLZTJrVX7H2UIVrdxCp/QIni90j8QFsUhyYWEY5tKCImTekibSKDWBDsCHL4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241940; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bqPC3vrxNuGDKf7z6T1UaFpDqZ6I4fCnbFesn89uZgs=; b=VbIEphziOfDQRqe1KR55fJMK/1LKYgV7GMi35kSdI5JqUUIbYNbHXWThn68lPyNYbram1Ly7FRuxKnbKjdXSXXOSsP2+5xmZ07l1edude1zhn9K/BYH0OMVThl9D8IcjOEgYCZ+n9wQdWdLT4+qrNB6QYBR2+reEj79hkmdVX8w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241940522627.0549080380514; Wed, 11 Mar 2026 08:12:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBm-0001LT-JM; Wed, 11 Mar 2026 11:09:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAN-00057V-He; Wed, 11 Mar 2026 11:08:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAL-0005Xs-0L; Wed, 11 Mar 2026 11:08:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0A120191E92; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id EA3AC37C2D3; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=B7Xyma4ORPJwDb6eJyWXh/OIOtfS6PL1qPgGD/rPWWQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nlxO+dMd8N3EPoGcvaP9VnCT+2eAuoqzQDgJo80JBjGA6gZoW+E/rlSPZySvclH9g vcx/7btBKnxqJCcQMpDfll3yFGrXxCYQkvOzIfqbT6BTDY2LWd309onZeVoctDvGxe BNw/JErBwiESj/kOMYCpz4UvnXouVFSxlUPRP4IwrBnlHk3gjKMDue635qObyTVdtl FTcPE6nOShEB0k1YtE9j4F0Tug8tdzLBWTfq8Jd2tUwifMaPYDF3coe4esu2hBgALi mJMjAhwtQ9OKAI+YqfSorEfsUlLHLJWW8Uy7ziG9LxKAKZYFvhY5LVsRoABJZhFFUJ OlFvokwRW1QjQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Akihiko Odaki , Dmitry Osipenko , Joelle van Dyne , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 15/46] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Date: Wed, 11 Mar 2026 18:02:51 +0300 Message-ID: <20260311150327.1084669-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241943627154100 Content-Type: text/plain; charset="utf-8" From: Akihiko Odaki Commit e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory region") made the name member of MemoryRegion unset, causing a NULL pointer dereference[1]: > Thread 2 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. > (gdb) bt > #0 0x00007ffff56565e2 in __strcmp_evex () at /lib64/libc.so.6 > #1 0x0000555555841bdb in find_fd (head=3D0x5555572337d0 , > name=3D0x0, id=3D0) at ../migration/cpr.c:68 > #2 cpr_delete_fd (name=3Dname@entry=3D0x0, id=3Did@entry=3D0) at > ../migration/cpr.c:77 > #3 0x000055555582290a in qemu_ram_free (block=3D0x7ff7e93aa7f0) at > ../system/physmem.c:2615 > #4 0x000055555581ae02 in memory_region_finalize (obj=3D) > at ../system/memory.c:1816 > #5 0x0000555555a70ab9 in object_deinit (obj=3D, > type=3D) at ../qom/object.c:715 > #6 object_finalize (data=3D0x7ff7e936eff0) at ../qom/object.c:729 > #7 object_unref (objptr=3D0x7ff7e936eff0) at ../qom/object.c:1232 > #8 0x0000555555814fae in memory_region_unref (mr=3D) at > ../system/memory.c:1848 > #9 flatview_destroy (view=3D0x555559ed6c40) at ../system/memory.c:301 > #10 0x0000555555bfc122 in call_rcu_thread (opaque=3D) at > ../util/rcu.c:324 > #11 0x0000555555bf17a7 in qemu_thread_start (args=3D0x555557b99520) at > ../util/qemu-thread-posix.c:393 > #12 0x00007ffff556f464 in start_thread () at /lib64/libc.so.6 > #13 0x00007ffff55f25ac in __clone3 () at /lib64/libc.so.6 The intention of the aforementioned commit is to prevent a MemoryRegion from parenting itself while its references is counted indendependently of the device. To achieve the same goal, add a type of QOM objects that count references and parent MemoryRegions. [1] https://lore.kernel.org/qemu-devel/4eb93d7a-1fa9-4b3c-8ad7-a2eb64f025a0= @collabora.com/ Cc: qemu-stable@nongnu.org Fixes: e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory regi= on") Fixes: da9b1cd37f66 ("virtio-gpu-virgl: correct parent for blob memory regi= on") in 10.1.x Signed-off-by: Akihiko Odaki Tested-by: Dmitry Osipenko Tested-by: Joelle van Dyne Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260214-region-v1-1-229f00ae1f38@rsg.ci.i.u-tokyo.ac.jp> (cherry picked from commit b2a279094c3b86667969cc645f7fb1087e08dd19) Signed-off-by: Michael Tokarev diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index b25ddc0746..362828f54e 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -52,11 +52,17 @@ virgl_get_egl_display(G_GNUC_UNUSED void *cookie) =20 #if VIRGL_VERSION_MAJOR >=3D 1 struct virtio_gpu_virgl_hostmem_region { + Object parent_obj; MemoryRegion mr; struct VirtIOGPU *g; bool finish_unmapping; }; =20 +#define TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION "virtio-gpu-virgl-hostmem-reg= ion" + +OBJECT_DECLARE_SIMPLE_TYPE(virtio_gpu_virgl_hostmem_region, + VIRTIO_GPU_VIRGL_HOSTMEM_REGION) + static struct virtio_gpu_virgl_hostmem_region * to_hostmem_region(MemoryRegion *mr) { @@ -70,14 +76,22 @@ static void virtio_gpu_virgl_resume_cmdq_bh(void *opaqu= e) virtio_gpu_process_cmdq(g); } =20 -static void virtio_gpu_virgl_hostmem_region_free(void *obj) +/* + * MR could outlive the resource if MR's reference is held outside of + * virtio-gpu. In order to prevent unmapping resource while MR is alive, + * and thus, making the data pointer invalid, we will block virtio-gpu + * command processing until MR is fully unreferenced and freed. + */ +static void virtio_gpu_virgl_hostmem_region_finalize(Object *obj) { - MemoryRegion *mr =3D MEMORY_REGION(obj); - struct virtio_gpu_virgl_hostmem_region *vmr; + struct virtio_gpu_virgl_hostmem_region *vmr =3D VIRTIO_GPU_VIRGL_HOSTM= EM_REGION(obj); VirtIOGPUBase *b; VirtIOGPUGL *gl; =20 - vmr =3D to_hostmem_region(mr); + if (!vmr->g) { + return; + } + vmr->finish_unmapping =3D true; =20 b =3D VIRTIO_GPU_BASE(vmr->g); @@ -92,11 +106,26 @@ static void virtio_gpu_virgl_hostmem_region_free(void = *obj) qemu_bh_schedule(gl->cmdq_resume_bh); } =20 +static const TypeInfo virtio_gpu_virgl_hostmem_region_info =3D { + .parent =3D TYPE_OBJECT, + .name =3D TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION, + .instance_size =3D sizeof(struct virtio_gpu_virgl_hostmem_region), + .instance_finalize =3D virtio_gpu_virgl_hostmem_region_finalize +}; + +static void virtio_gpu_virgl_types(void) +{ + type_register_static(&virtio_gpu_virgl_hostmem_region_info); +} + +type_init(virtio_gpu_virgl_types) + static int virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, struct virtio_gpu_virgl_resource *res, uint64_t offset) { + g_autofree char *name =3D NULL; struct virtio_gpu_virgl_hostmem_region *vmr; VirtIOGPUBase *b =3D VIRTIO_GPU_BASE(g); MemoryRegion *mr; @@ -117,21 +146,16 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, } =20 vmr =3D g_new0(struct virtio_gpu_virgl_hostmem_region, 1); + name =3D g_strdup_printf("blob[%" PRIu32 "]", res->base.resource_id); + object_initialize_child(OBJECT(g), name, vmr, + TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION); vmr->g =3D g; =20 mr =3D &vmr->mr; - memory_region_init_ram_ptr(mr, OBJECT(mr), NULL, size, data); + memory_region_init_ram_ptr(mr, OBJECT(vmr), "mr", size, data); memory_region_add_subregion(&b->hostmem, offset, mr); memory_region_set_enabled(mr, true); =20 - /* - * MR could outlive the resource if MR's reference is held outside of - * virtio-gpu. In order to prevent unmapping resource while MR is aliv= e, - * and thus, making the data pointer invalid, we will block virtio-gpu - * command processing until MR is fully unreferenced and freed. - */ - OBJECT(mr)->free =3D virtio_gpu_virgl_hostmem_region_free; - res->mr =3D mr; =20 return 0; @@ -159,7 +183,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, * 1. Begin async unmapping with memory_region_del_subregion() * and suspend/block cmd processing. * 2. Wait for res->mr to be freed and cmd processing resumed - * asynchronously by virtio_gpu_virgl_hostmem_region_free(). + * asynchronously by virtio_gpu_virgl_hostmem_region_finalize(). * 3. Finish the unmapping with final virgl_renderer_resource_unmap(). */ if (vmr->finish_unmapping) { @@ -182,7 +206,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, /* memory region owns self res->mr object and frees it by itself */ memory_region_set_enabled(mr, false); memory_region_del_subregion(&b->hostmem, mr); - object_unref(OBJECT(mr)); + object_unparent(OBJECT(vmr)); } =20 return 0; --=20 2.47.3