| Message ID | 20201220163539.2255963-1-laurent@vivier.eu |
|---|---|
| State | New |
| Headers | show |
| Series | virtio-mmio: fix guest kernel crash with SHM regions | expand |
Hi, any comment? Thanks, Laurent Le 20/12/2020 à 17:35, Laurent Vivier a écrit : > In the kernel, virtio_gpu_init() uses virtio_get_shm_region() > since > commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region") > but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to > get the address and the length of the region. > > commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport" > > As this is not implemented in QEMU, address and length are 0 and passed > as is to devm_request_mem_region() that triggers a crash: > > [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region > Unable to handle kernel NULL pointer dereference at virtual address (ptrval) > > According to the comments in the kernel, a non existent shared region > has a length of (u64)-1. > > This is what we return now with this patch to disable the region. > > Signed-off-by: Laurent Vivier <laurent@vivier.eu> > --- > hw/virtio/virtio-mmio.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c > index e1b5c3b81e37..610661d6a526 100644 > --- a/hw/virtio/virtio-mmio.c > +++ b/hw/virtio/virtio-mmio.c > @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size) > return 0; > } > return vdev->generation; > + case VIRTIO_MMIO_SHM_LEN_LOW: > + case VIRTIO_MMIO_SHM_LEN_HIGH: > + /* > + * VIRTIO_MMIO_SHM_SEL is unimplemented > + * according to the linux driver, if region length is -1 > + * the shared memory doesn't exist > + */ > + return -1; > case VIRTIO_MMIO_DEVICE_FEATURES_SEL: > case VIRTIO_MMIO_DRIVER_FEATURES: > case VIRTIO_MMIO_DRIVER_FEATURES_SEL: >
Hi, > > According to the comments in the kernel, a non existent shared region > > has a length of (u64)-1. virtio spec says the same. > > + case VIRTIO_MMIO_SHM_LEN_LOW: > > + case VIRTIO_MMIO_SHM_LEN_HIGH: > > + /* > > + * VIRTIO_MMIO_SHM_SEL is unimplemented > > + * according to the linux driver, if region length is -1 > > + * the shared memory doesn't exist > > + */ > > + return -1; Acked-by: Gerd Hoffmann <kraxel@redhat.com> take care, Gerd
On Sun, Dec 20, 2020 at 05:35:39PM +0100, Laurent Vivier wrote: >In the kernel, virtio_gpu_init() uses virtio_get_shm_region() >since >commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region") >but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to >get the address and the length of the region. > >commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport" > >As this is not implemented in QEMU, address and length are 0 and passed >as is to devm_request_mem_region() that triggers a crash: > > [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region > Unable to handle kernel NULL pointer dereference at virtual address (ptrval) > >According to the comments in the kernel, a non existent shared region >has a length of (u64)-1. > >This is what we return now with this patch to disable the region. > >Signed-off-by: Laurent Vivier <laurent@vivier.eu> >--- > hw/virtio/virtio-mmio.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c >index e1b5c3b81e37..610661d6a526 100644 >--- a/hw/virtio/virtio-mmio.c >+++ b/hw/virtio/virtio-mmio.c >@@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size) > return 0; > } > return vdev->generation; >+ case VIRTIO_MMIO_SHM_LEN_LOW: >+ case VIRTIO_MMIO_SHM_LEN_HIGH: >+ /* >+ * VIRTIO_MMIO_SHM_SEL is unimplemented >+ * according to the linux driver, if region length is -1 >+ * the shared memory doesn't exist >+ */ >+ return -1; > case VIRTIO_MMIO_DEVICE_FEATURES_SEL: > case VIRTIO_MMIO_DRIVER_FEATURES: > case VIRTIO_MMIO_DRIVER_FEATURES_SEL: >-- >2.29.2 > > Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Anyone to merge this? Thanks, Laurent Le 20/12/2020 à 17:35, Laurent Vivier a écrit : > In the kernel, virtio_gpu_init() uses virtio_get_shm_region() > since > commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region") > but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to > get the address and the length of the region. > > commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport" > > As this is not implemented in QEMU, address and length are 0 and passed > as is to devm_request_mem_region() that triggers a crash: > > [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region > Unable to handle kernel NULL pointer dereference at virtual address (ptrval) > > According to the comments in the kernel, a non existent shared region > has a length of (u64)-1. > > This is what we return now with this patch to disable the region. > > Signed-off-by: Laurent Vivier <laurent@vivier.eu> > --- > hw/virtio/virtio-mmio.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c > index e1b5c3b81e37..610661d6a526 100644 > --- a/hw/virtio/virtio-mmio.c > +++ b/hw/virtio/virtio-mmio.c > @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size) > return 0; > } > return vdev->generation; > + case VIRTIO_MMIO_SHM_LEN_LOW: > + case VIRTIO_MMIO_SHM_LEN_HIGH: > + /* > + * VIRTIO_MMIO_SHM_SEL is unimplemented > + * according to the linux driver, if region length is -1 > + * the shared memory doesn't exist > + */ > + return -1; > case VIRTIO_MMIO_DEVICE_FEATURES_SEL: > case VIRTIO_MMIO_DRIVER_FEATURES: > case VIRTIO_MMIO_DRIVER_FEATURES_SEL: >
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c index e1b5c3b81e37..610661d6a526 100644 --- a/hw/virtio/virtio-mmio.c +++ b/hw/virtio/virtio-mmio.c @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size) return 0; } return vdev->generation; + case VIRTIO_MMIO_SHM_LEN_LOW: + case VIRTIO_MMIO_SHM_LEN_HIGH: + /* + * VIRTIO_MMIO_SHM_SEL is unimplemented + * according to the linux driver, if region length is -1 + * the shared memory doesn't exist + */ + return -1; case VIRTIO_MMIO_DEVICE_FEATURES_SEL: case VIRTIO_MMIO_DRIVER_FEATURES: case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
In the kernel, virtio_gpu_init() uses virtio_get_shm_region() since commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region") but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to get the address and the length of the region. commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport" As this is not implemented in QEMU, address and length are 0 and passed as is to devm_request_mem_region() that triggers a crash: [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region Unable to handle kernel NULL pointer dereference at virtual address (ptrval) According to the comments in the kernel, a non existent shared region has a length of (u64)-1. This is what we return now with this patch to disable the region. Signed-off-by: Laurent Vivier <laurent@vivier.eu> --- hw/virtio/virtio-mmio.c | 8 ++++++++ 1 file changed, 8 insertions(+)