On failure to request msix vectors virtio frees the vector map but fails
to reset it.  It will then attempt to use that map in vp_remove_vqs on
device removal and hybernation, resulting in memory corruption
manifesting as warnings in PCI core, hangs etc.

Reported-by: Mike Galbraith <efa...@gmx.de>
Fixes: 07ec51480b5e ("virtio_pci: use shared interrupts for virtqueues")
Signed-off-by: Michael S. Tsirkin <m...@redhat.com>
---
 drivers/virtio/virtio_pci_common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/virtio/virtio_pci_common.c 
b/drivers/virtio/virtio_pci_common.c
index 2a353ab..2b1ea9b 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -266,6 +266,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, 
unsigned nvqs,
 out_remove_vqs:
        vp_remove_vqs(vdev);
        kfree(vp_dev->msix_vector_map);
+       vp_dev->msix_vector_map = NULL;
 out_disable_config_irq:
        vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
 out_free_config_irq:
-- 
MST

Reply via email to