On 2017年09月21日 02:53, Felipe Franciosi wrote:
vhost_log_put() is called to decomission the dirty log between qemu and a vhost device when stopping the device. Such a call can happen from migration_completion(). Present code sets dev->log_size to zero too early in vhost_log_put(), causing the sync check to always return false. As a consequence, the last pass on the dirty bitmap never happens at the end of migration. If a vhost device was busy (writing to guest memory) until the last moments before vhost_virtqueue_stop(), this error will result in guest memory corruption (at least) following migrations. Signed-off-by: Felipe Franciosi <fel...@nutanix.com> --- hw/virtio/vhost.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 5fd69f0..ddc42f0 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -375,8 +375,6 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync) if (!log) { return; } - dev->log = NULL; - dev->log_size = 0;--log->refcnt;if (log->refcnt == 0) { @@ -396,6 +394,9 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync)g_free(log);} + + dev->log = NULL; + dev->log_size = 0; }static bool vhost_dev_log_is_shared(struct vhost_dev *dev)
Cc: qemu-sta...@nongnu.org Acked-by: Jason Wang <jasow...@redhat.com> Thanks
