From nobody Tue Apr 7 21:28:20 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773257923; cv=none; d=zohomail.com; s=zohoarc; b=ZInZIiZmco/BVjuI6l1FRE2s+Q4lH1JCodtlORWmbSGT85Bk+hojFfyhnsDzI+lrZHDAA39qJqZWuJowhYFN3IWwbWx7nryjiR76mz5mSfDzOGOXyBQTyyKw9BCM23jm+l4CkULOm30e+AXMWfi+Urw7Lq+FAvJbwqmKUSmJWGk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773257923; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wXHKdmvB1dC6YxWpDPRS7pClvOFFb5OWIBFihxbPkA0=; b=RDbT7PwnD2Hhx4s1Trpr923mo9aJEjiCJ4HrPg2exVmDv/sf/GhqbP1mGLZe7AgMdXEa39rttKF5aTVVRP/SZAPjwkYJERj93o/7bxB/zCgnwj1zobG97qJMLquKFyDdUV+LtQyKLNbq6fZaqUv8VRIhj7OzudL5XYsWJk6xEag= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773257923469912.8001060567426; Wed, 11 Mar 2026 12:38:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0PLi-0007uY-HR; Wed, 11 Mar 2026 15:36:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0PLc-0007nh-84; Wed, 11 Mar 2026 15:36:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0PLa-0000Cy-8X; Wed, 11 Mar 2026 15:35:59 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5CC9E1920F8; Wed, 11 Mar 2026 22:34:27 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9B95A37C45D; Wed, 11 Mar 2026 22:35:05 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773257667; bh=S2/IgILclxRZ7ljyqnMuw+A6wuBRT3cl3juQKdZVFKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=w7wF94825tsqLtW9TShEHklywyVnx0KIe5e85MwCeB8YX1PoWUgZDHWf16j9CWrYr LaZNpa1ptpFtiJm+dsyc4Kn77XooWfWKYTQDTK4y7KJBYNXcJVOkxSvHfFW/ZGISUl f6cu157rEhuUviEtYY7IYojJtahYgasSdMlpzZrBMvxFGbEYe7G9FL8I36OIinD00X dnHIobbXDKsiR8RNeqcjDZWam4XpsT7wUOcFp8+8GsftItMTqHZvs4IoHMj+h3sgm6 oYqjd1WnKK8/csyTbcPv27Hp35LFohyGlzO9mPahrfmzSpfhAjJinjdZ6iFBnehlBK VRSC5SMcecHLg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Akihiko Odaki , Dmitry Osipenko , Joelle van Dyne , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.2.2 16/53] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Date: Wed, 11 Mar 2026 22:34:09 +0300 Message-ID: <20260311193449.1096110-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773257925409158500 Content-Type: text/plain; charset="utf-8" From: Akihiko Odaki Commit e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory region") made the name member of MemoryRegion unset, causing a NULL pointer dereference[1]: > Thread 2 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. > (gdb) bt > #0 0x00007ffff56565e2 in __strcmp_evex () at /lib64/libc.so.6 > #1 0x0000555555841bdb in find_fd (head=3D0x5555572337d0 , > name=3D0x0, id=3D0) at ../migration/cpr.c:68 > #2 cpr_delete_fd (name=3Dname@entry=3D0x0, id=3Did@entry=3D0) at > ../migration/cpr.c:77 > #3 0x000055555582290a in qemu_ram_free (block=3D0x7ff7e93aa7f0) at > ../system/physmem.c:2615 > #4 0x000055555581ae02 in memory_region_finalize (obj=3D) > at ../system/memory.c:1816 > #5 0x0000555555a70ab9 in object_deinit (obj=3D, > type=3D) at ../qom/object.c:715 > #6 object_finalize (data=3D0x7ff7e936eff0) at ../qom/object.c:729 > #7 object_unref (objptr=3D0x7ff7e936eff0) at ../qom/object.c:1232 > #8 0x0000555555814fae in memory_region_unref (mr=3D) at > ../system/memory.c:1848 > #9 flatview_destroy (view=3D0x555559ed6c40) at ../system/memory.c:301 > #10 0x0000555555bfc122 in call_rcu_thread (opaque=3D) at > ../util/rcu.c:324 > #11 0x0000555555bf17a7 in qemu_thread_start (args=3D0x555557b99520) at > ../util/qemu-thread-posix.c:393 > #12 0x00007ffff556f464 in start_thread () at /lib64/libc.so.6 > #13 0x00007ffff55f25ac in __clone3 () at /lib64/libc.so.6 The intention of the aforementioned commit is to prevent a MemoryRegion from parenting itself while its references is counted indendependently of the device. To achieve the same goal, add a type of QOM objects that count references and parent MemoryRegions. [1] https://lore.kernel.org/qemu-devel/4eb93d7a-1fa9-4b3c-8ad7-a2eb64f025a0= @collabora.com/ Cc: qemu-stable@nongnu.org Fixes: e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory regi= on") Fixes: be88ad424c0b ("virtio-gpu-virgl: correct parent for blob memory regi= on") for 10.2.x Signed-off-by: Akihiko Odaki Tested-by: Dmitry Osipenko Tested-by: Joelle van Dyne Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260214-region-v1-1-229f00ae1f38@rsg.ci.i.u-tokyo.ac.jp> (cherry picked from commit b2a279094c3b86667969cc645f7fb1087e08dd19) Signed-off-by: Michael Tokarev diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index 741728cabb..4e515c4ef6 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -52,11 +52,17 @@ virgl_get_egl_display(G_GNUC_UNUSED void *cookie) =20 #if VIRGL_VERSION_MAJOR >=3D 1 struct virtio_gpu_virgl_hostmem_region { + Object parent_obj; MemoryRegion mr; struct VirtIOGPU *g; bool finish_unmapping; }; =20 +#define TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION "virtio-gpu-virgl-hostmem-reg= ion" + +OBJECT_DECLARE_SIMPLE_TYPE(virtio_gpu_virgl_hostmem_region, + VIRTIO_GPU_VIRGL_HOSTMEM_REGION) + static struct virtio_gpu_virgl_hostmem_region * to_hostmem_region(MemoryRegion *mr) { @@ -70,14 +76,22 @@ static void virtio_gpu_virgl_resume_cmdq_bh(void *opaqu= e) virtio_gpu_process_cmdq(g); } =20 -static void virtio_gpu_virgl_hostmem_region_free(void *obj) +/* + * MR could outlive the resource if MR's reference is held outside of + * virtio-gpu. In order to prevent unmapping resource while MR is alive, + * and thus, making the data pointer invalid, we will block virtio-gpu + * command processing until MR is fully unreferenced and freed. + */ +static void virtio_gpu_virgl_hostmem_region_finalize(Object *obj) { - MemoryRegion *mr =3D MEMORY_REGION(obj); - struct virtio_gpu_virgl_hostmem_region *vmr; + struct virtio_gpu_virgl_hostmem_region *vmr =3D VIRTIO_GPU_VIRGL_HOSTM= EM_REGION(obj); VirtIOGPUBase *b; VirtIOGPUGL *gl; =20 - vmr =3D to_hostmem_region(mr); + if (!vmr->g) { + return; + } + vmr->finish_unmapping =3D true; =20 b =3D VIRTIO_GPU_BASE(vmr->g); @@ -92,11 +106,26 @@ static void virtio_gpu_virgl_hostmem_region_free(void = *obj) qemu_bh_schedule(gl->cmdq_resume_bh); } =20 +static const TypeInfo virtio_gpu_virgl_hostmem_region_info =3D { + .parent =3D TYPE_OBJECT, + .name =3D TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION, + .instance_size =3D sizeof(struct virtio_gpu_virgl_hostmem_region), + .instance_finalize =3D virtio_gpu_virgl_hostmem_region_finalize +}; + +static void virtio_gpu_virgl_types(void) +{ + type_register_static(&virtio_gpu_virgl_hostmem_region_info); +} + +type_init(virtio_gpu_virgl_types) + static int virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, struct virtio_gpu_virgl_resource *res, uint64_t offset) { + g_autofree char *name =3D NULL; struct virtio_gpu_virgl_hostmem_region *vmr; VirtIOGPUBase *b =3D VIRTIO_GPU_BASE(g); MemoryRegion *mr; @@ -117,21 +146,16 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, } =20 vmr =3D g_new0(struct virtio_gpu_virgl_hostmem_region, 1); + name =3D g_strdup_printf("blob[%" PRIu32 "]", res->base.resource_id); + object_initialize_child(OBJECT(g), name, vmr, + TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION); vmr->g =3D g; =20 mr =3D &vmr->mr; - memory_region_init_ram_ptr(mr, OBJECT(mr), NULL, size, data); + memory_region_init_ram_ptr(mr, OBJECT(vmr), "mr", size, data); memory_region_add_subregion(&b->hostmem, offset, mr); memory_region_set_enabled(mr, true); =20 - /* - * MR could outlive the resource if MR's reference is held outside of - * virtio-gpu. In order to prevent unmapping resource while MR is aliv= e, - * and thus, making the data pointer invalid, we will block virtio-gpu - * command processing until MR is fully unreferenced and freed. - */ - OBJECT(mr)->free =3D virtio_gpu_virgl_hostmem_region_free; - res->mr =3D mr; =20 trace_virtio_gpu_cmd_res_map_blob(res->base.resource_id, vmr, mr); @@ -163,7 +187,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, * 1. Begin async unmapping with memory_region_del_subregion() * and suspend/block cmd processing. * 2. Wait for res->mr to be freed and cmd processing resumed - * asynchronously by virtio_gpu_virgl_hostmem_region_free(). + * asynchronously by virtio_gpu_virgl_hostmem_region_finalize(). * 3. Finish the unmapping with final virgl_renderer_resource_unmap(). */ if (vmr->finish_unmapping) { @@ -186,7 +210,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, /* memory region owns self res->mr object and frees it by itself */ memory_region_set_enabled(mr, false); memory_region_del_subregion(&b->hostmem, mr); - object_unref(OBJECT(mr)); + object_unparent(OBJECT(vmr)); } =20 return 0; --=20 2.47.3