From patchwork Mon Jan 28 17:42:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1032090 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="AStiOsCS"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43pH7V0kjzz9s3l for ; Tue, 29 Jan 2019 04:44:22 +1100 (AEDT) Received: from localhost ([127.0.0.1]:35996 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1goAxI-0005WR-1R for incoming@patchwork.ozlabs.org; Mon, 28 Jan 2019 12:44:20 -0500 Received: from eggs.gnu.org ([209.51.188.92]:32888) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1goAvn-0004hJ-PL for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1goAvm-0006Yd-SU for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:47 -0500 Received: from mail-wr1-x444.google.com ([2a00:1450:4864:20::444]:45016) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1goAvm-0006WK-Km for qemu-devel@nongnu.org; Mon, 28 Jan 2019 12:42:46 -0500 Received: by mail-wr1-x444.google.com with SMTP id z5so19013510wrt.11 for ; Mon, 28 Jan 2019 09:42:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ut+xye7LMbCcrynN5ix96kyuLn+DHT6QmHWVyHDBmDc=; b=AStiOsCSIpLwctXwmkPAUvYgEXni1le4nWxP1wWaC2GjSaEVnn7wrct78vvNFB/Cud 5laItxTWFb9vaTJI4KjZ7bXJegfvXoZfunSh1rgrm9X4KTIldGLZt9VxB/YFwJjweiyv 7X0wJAhmuODAA7f67IjpncF09zg7huD/k2EcI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ut+xye7LMbCcrynN5ix96kyuLn+DHT6QmHWVyHDBmDc=; b=mrYArkszr3PbDQwsJS42pWKVd+mf8H2C2pGa0RfWBQUY/drlJI/FlkUXzLuVJawzPG TznDaafWgrk7nBz8u5vqt75kfKXhUXc7Jr3f8J44k7YYyaMt67zDGrSBjp1jDAT8ISrg uptmB9eYwXGLmc2GuBj+1xR9j4GroC14muFKiY5zlYYxECMUYU85phzv2cUYj+lKCGrZ ez9RgpDiMqavoseazi8NIR9nM/Ii0HYfs0a5vVv2/nco9GmqkSSiHhSWGFoJBmxTfJ4A vO6i11a/+L29KyDMhkzJDWHXODFlIt4ZPN9FaW6+/ThqTwGfVKkpK8eBBfBW3jFlwPlk sDRA== X-Gm-Message-State: AJcUukceK7PdOp9NEFIraPRdaK9t3nMizIDmtO8e/r+6cT6PeuRN9NPa MNS6clNQLsDe6SIQFvo0keI11pw6ZBD6dA== X-Google-Smtp-Source: ALg8bN6/FwzxmIDv9pYWc8G2FUF+h9gbDt7shDfaXjPMmlQ4yavcQlvDQ4wp1oBWloVuixcZ0oIfDg== X-Received: by 2002:a5d:524b:: with SMTP id p11mr21726995wrv.147.1548697363767; Mon, 28 Jan 2019 09:42:43 -0800 (PST) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [81.2.115.148]) by smtp.gmail.com with ESMTPSA id a12sm127767519wro.18.2019.01.28.09.42.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Jan 2019 09:42:42 -0800 (PST) From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 28 Jan 2019 17:42:41 +0000 Message-Id: <20190128174241.5860-1-peter.maydell@linaro.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::444 Subject: [Qemu-devel] [PATCH] exec.c: Don't reallocate IOMMUNotifiers that are in use X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Richard Henderson , patches@linaro.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" The tcg_register_iommu_notifier() code has a GArray of TCGIOMMUNotifier structs which it has registered by passing memory_region_register_iommu_notifier() a pointer to the embedded IOMMUNotifier field. Unfortunately, if we need to enlarge the array via g_array_set_size() this can cause a realloc(), which invalidates the pointer that memory_region_register_iommu_notifier() put into the MemoryRegion's iommu_notify list. This can result in segfaults. Switch the GArray to holding pointers to the TCGIOMMUNotifier structs, so that we can individually allocate and free them. Cc: qemu-stable@nongnu.org Fixes: 1f871c5e6b0f30644a60a ("exec.c: Handle IOMMUs in address_space_translate_for_iotlb()") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson --- I don't know why I've suddenly started running into this; possibly it's because of a recent Ubuntu upgrade and so a newer glibc. --- exec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/exec.c b/exec.c index 895449f9261..cf6bc72c976 100644 --- a/exec.c +++ b/exec.c @@ -665,7 +665,7 @@ static void tcg_register_iommu_notifier(CPUState *cpu, int i; for (i = 0; i < cpu->iommu_notifiers->len; i++) { - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i); if (notifier->mr == mr && notifier->iommu_idx == iommu_idx) { break; } @@ -673,7 +673,8 @@ static void tcg_register_iommu_notifier(CPUState *cpu, if (i == cpu->iommu_notifiers->len) { /* Not found, add a new entry at the end of the array */ cpu->iommu_notifiers = g_array_set_size(cpu->iommu_notifiers, i + 1); - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_new0(TCGIOMMUNotifier, 1); + g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i) = notifier; notifier->mr = mr; notifier->iommu_idx = iommu_idx; @@ -705,8 +706,9 @@ static void tcg_iommu_free_notifier_list(CPUState *cpu) TCGIOMMUNotifier *notifier; for (i = 0; i < cpu->iommu_notifiers->len; i++) { - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i); memory_region_unregister_iommu_notifier(notifier->mr, ¬ifier->n); + g_free(notifier); } g_array_free(cpu->iommu_notifiers, true); } @@ -976,7 +978,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp) vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu); } - cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier)); + cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier *)); #endif }