On Tue, 23 Feb 2021 at 10:13, Jason Wang <[email protected]> wrote:
> > On 2021/2/22 下午5:13, Gautam Dawar wrote: > > When qemu with vhost-vdpa netdevice is run for the first time, it > > works well. > > But after the VM is powered off, the next qemu run causes kernel panic > > due to > > a NULL pointer dereference in irq_bypass_register_producer(). > > > > When the VM is powered off, vhost_vdpa_clean_irq() misses on calling > > irq_bypass_unregister_producer() for irq 0 because of the existing check. > > > > This leaves stale producer nodes, which are reset in > > vhost_vring_call_reset() > > when vhost_dev_init() is invoked during the second qemu run. > > > > As the node member of struct irq_bypass_producer is also initialized > > to zero, traversal on the producers list causes crash due to NULL pointer > > dereference. > > > > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=211711 > > Signed-off-by: Gautam Dawar <[email protected] <mailto:[email protected] > >> > > > > > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > > index 62a9bb0efc55..d1c3a33c6239 100644 > > --- a/drivers/vhost/vdpa.c > > +++ b/drivers/vhost/vdpa.c > > @@ -849,7 +849,7 @@ static void vhost_vdpa_clean_irq(struct vhost_vdpa > *v) > > > > for (i = 0; i < v->nvqs; i++) { > > vq = &v->vqs[i]; > > - if (vq->call_ctx.producer.irq) > > + if (vq->call_ctx.producer.irq >= 0) > > irq_bypass_unregister_producer(&vq->call_ctx.producer); > > > Since it's impossible to have an irq < 0 ( see > vhost_vdap_setup_vq_irq()), I think we can simply remove the check above. > > Then we can call vhost_vdpa_unsetup_vq_irq() here to avoid temporary > variable like vq. > > Done and submitted patch v2. > Thanks > > > > } > > } > > Regards, Gautam
_______________________________________________ Virtualization mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/virtualization
