diff options
| author | Felipe Franciosi | 2017-09-20 20:53:06 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin | 2017-10-15 04:54:41 +0200 |
| commit | 5c0ba1be37181bd8a7c96c7f81b19ae5f8e66e2d (patch) | |
| tree | 16cb6b7509dd5e8c38af51364adfd27ce8568cac /hw | |
| parent | MAINTAINERS: add Dump maintainers (diff) | |
| download | qemu-5c0ba1be37181bd8a7c96c7f81b19ae5f8e66e2d.tar.gz qemu-5c0ba1be37181bd8a7c96c7f81b19ae5f8e66e2d.tar.xz qemu-5c0ba1be37181bd8a7c96c7f81b19ae5f8e66e2d.zip | |
virtio/vhost: reset dev->log after syncing
vhost_log_put() is called to decomission the dirty log between qemu and
a vhost device when stopping the device. Such a call can happen from
migration_completion().
Present code sets dev->log_size to zero too early in vhost_log_put(),
causing the sync check to always return false. As a consequence, the
last pass on the dirty bitmap never happens at the end of migration.
If a vhost device was busy (writing to guest memory) until the last
moments before vhost_virtqueue_stop(), this error will result in guest
memory corruption (at least) following migrations.
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/virtio/vhost.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 5fd69f0b2e..ddc42f0f93 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -375,8 +375,6 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync) if (!log) { return; } - dev->log = NULL; - dev->log_size = 0; --log->refcnt; if (log->refcnt == 0) { @@ -396,6 +394,9 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync) g_free(log); } + + dev->log = NULL; + dev->log_size = 0; } static bool vhost_dev_log_is_shared(struct vhost_dev *dev) |