From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021102.outbound.protection.outlook.com [52.101.65.102]) by lore.virtuozzo.com (Postfix) with ESMTPS id D759980B96 for ; Tue, 20 Oct 2026 16:30:57 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wri8Hz4IbJT0eSOL1c343gG4oOXlOrmSn7byjkwdzUiGR44csGdGpDv0N+qaZvxhrHnodHLD03RjSqm8x54fXnf+Mpw8rOjrXmoUqGUOHRGSjZdtChWlXPOlO6ygIqg79AhyNzT2KTmarg6IqofC1e4Eoybb0CyqF2ustnKlPoQMNu2Ex4+/MRw+ATJVVATi1i6sqnkEvbeGFMUbuZqOYnwkPKdTsY3OKPwerj8P3y7bdY4PqK7wzO4WNSot2Ic7rnmnt6plRZP7HK775+f6tQNIUK/AOI8HMg3DVl1TMlN+Wk+ASgiUN+oyxZ8F2+3GSLHR+CgOAe+XBG/tgjX0tw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=hPoQaJ7/YRqrFi2HExBD1jZrzyEHllOlCDyPKlMQyvoJquoiV9xIRbNJ2CgVQwFr9xajZ584F+tonAC22DTiP6m66HOhAaR4xTzIHhoWzmRGCu6LC9EXXA4NWU+dfeatndz/fB+6vzl/nlGapUNAFgo0vq5+dcvRdbtfqpQ8KfU6duXLHrwzfwcBYzA+FLDjbZklC0zEqPlSgzLB5w/N+7jOjvQse0SgIM9NVEe7hzn8ofegh56rmjgCU7mJjF84F4nptsfU6VOkzNUW1Zy4ZOplqqKx7WXigv4AP7WLM6j2UtMeXNXHkkiXmQV+5RytVRmpySCAxJTFLkATDHPsdg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=ZNFx5+lhqCTNN8lONnkpz59E8HMRFglPIcawySTyQG77YeBkr8PKSWxDksUSLg6CBrr/RK45eo0i9dyOpwlMsjLBv0j22gWeL3ShpUtVASV7GMGQ6FxlYbk08KYg1i4yaJldfRXxzyTHqV0N4MYlE+iWcozQqd2QDKkMxh35BAv5zOznSVQqXpKnxTX31qCCBc1/pCJEeVGbSNLkT4j6hA2P+2Q5w2nNpmzjDuzTAE5zmlFMGWzm3fLL2MNu1Qqx6MHtxNsEvoj6U9d0fIIaV2pv7cJPnxsuW5EUwgzJe1sL7oARzybAGevcuLhH6/3Nj0cbphGTSV8faQKPpEXDvA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB10683.eurprd08.prod.outlook.com (2603:10a6:800:208::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Tue, 20 Oct 2026 16:30:55 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 16:30:55 +0000 From: Andrey Drobyshev Date: Tue, 20 Oct 2026 19:30:47 +0300 Subject: [PATCH QEMU HCI-8.1 v4 07/31] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261020-vfio_v1-v4-7-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> In-Reply-To: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0056.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB10683:EE_ X-MS-Office365-Filtering-Correlation-Id: 55548633-d15e-4f88-4bfc-08df2ec782a5 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|52116014|376014|366016|23010399003|1800799024|260925021911599003|260925021311599003|260925022911599003|261009223027099003|10067099003|5113699003|22082099003|18002099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: 9414mWjocPK2ClDBz5sbQjCB25yRBXWMpnA/cd6KNk9KIG4GUQooOehXO6sE4hd3GYtdL8NC7vO+iKr/Pp27lQP4SeAGvo3RDdP6IhuXDk4RQnyk5JeE5Wdau14d9km8FMRtVfPFuEO6EHgSjV2gOIZLJWa2FscUvK27RF6dTfDtNZNnJaptM/uO+MnM2zdgj0MwqlS//4HGmNtPV8S48H7t6f1dTP+DMMxph0BaXj8d5r7hgdxRw1G1pMTrct+ly1yZV7FUQTNGuDF/0QU/iLY31iNfAntAzMNO0MYtaWWk4wTO41mKhMFo/BcXmSU1Gkk+SZnSx4i0ykQK7U8w36z89ZLIZLPeGzo7qZU+naeavorREDWLR/e4xyacN96r9Z5G7UfMUJ5uoGpZ4zUDj4WJckKTJVRriRPGlE3R7IQE+is9QvUVk1Jbqmhg91+iduSrnixSd/cRN29VG3iu5yRitMioYA1LjZQDhDUt7ZBVzh5soZ1PqwceIZHBfh+J0XMRyDPvlAFX+gTzm3ieGwUSEJI4ROnpWhCbnGg3VoT0X2Adrm3euwRdM8/RqDzKrrjzfA1fpBOv81fKfC/whlf9ljO5QSD0b1tcV8n4XqA4DDvkYlhZnHcxLbzCupor8uuhT2spPal28VPrYk5TzeNnSZDgZQWaSMyNBYs8ilE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(52116014)(376014)(366016)(23010399003)(1800799024)(260925021911599003)(260925021311599003)(260925022911599003)(261009223027099003)(10067099003)(5113699003)(22082099003)(18002099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bTgrYU9mVVd0YXFOMU9nNndwVmZwY0Vyb2ZqUUc5WTFORW5ialJjV1p5a3Yx?= =?utf-8?B?T3F0VWNCazBkM09YaHplTGM2WHJrQmlqVmkxR01ub2prYlYwVmNKQlEzazI0?= =?utf-8?B?N3drSm82aHp4THg0Uk80ZmtBS01GcXVMcU8wR3pITU1vQnJrRitteGNESC8z?= =?utf-8?B?bkNxSm1IR0RsY1lSYTdQWGJHMTdkbGhLeFA4ZCtZeCtxbnV2Ny9naTJCZGVr?= =?utf-8?B?MW5hbEc0aVNvYkhmV1RyZkdFZnJTRjhqUnJaaVJ3RXo1V1NWcjJmUGNDNHI3?= =?utf-8?B?UlYvZEJaN3ZhZGtnRWo1MjZ5ZkVHTlcrSXh0ZE9VMGgrRzJuU04vMXJoaHlz?= =?utf-8?B?QU9hc08rTkRKNXVidkQzSmhqdlZJVmN6SXVRT1VOMXhyQmg3OTFFbzU0Mi84?= =?utf-8?B?ZDJQemdXTklzSTNCdkxFNWdHTlJuUG04M0p1MlNkcWRZVjZQSU1WSEY4L3NW?= =?utf-8?B?eW9kaGZHQ3Faa3h1KzhnMFVYSDV6VEk0eklSQ0ZjMXVKV1NOY1NlZ1BXTFha?= =?utf-8?B?ZGk3RjA3cWNxZGlYcit1NkRXN20yMTV5Tk5KYnI5WFFtSXlTbWxiYS9CbjlW?= =?utf-8?B?SnFka2VvMStpNFdwbEtOcDZnTElDbTV3S0phV1FacXRWN29GVjlHRlhLVEVH?= =?utf-8?B?aWFrcE9rRDlwVGpMTWRRcHNRMlZMRkxSdjZKTUJkdDMzSzFqOWUxYkdTSWpN?= =?utf-8?B?bWV3eXpLZVhXVExKNURuOFFFbGZBSG1vSzl3a0ptK05INHR0UVczelFQZWE4?= =?utf-8?B?RURHcE9UOC8vbWlwVXk0LzFuUzdpUzA3alJzYzhZRmY3NXNwc3BiRzRJOTlp?= =?utf-8?B?ZFhmd2hqbDNWVlFrU2dnZWJGK3BkK1pTbjI3WGZsWFozT2hHcXczRVN4cEJL?= =?utf-8?B?WVV6T3JGWmQrcVQvV2h0dVQ3ZmswNkhIVmtiV2wrcDBkU0hXSHduakhEdjk0?= =?utf-8?B?WG0zeHFkQ2h4Z1hhZU1nWmhkUGQ5WUZqZVFVUExLSnJQK2hMNjhoZWtUZ0lK?= =?utf-8?B?M2FxOEMraTh2SVpMMlllMFQ0QnFaRndMYWFzMUVOWHB5dE5SbVJWWXlxRVBU?= =?utf-8?B?WHpqMHUxemYrYzBEV1dPQ3pUOFl3VUtVR1hwd2pubHE3bzJaamIyNDhidkty?= =?utf-8?B?UlpTZTluaVJNbXRGZEJjcm9makRyNFRmWDgvbHNCZWpYUG5NZ0VnSk13a1U0?= =?utf-8?B?ODJiTmN4Z0lDZ1ptdk9hZHFvVHowWGQzc0pMU2pGWFo1Vlo1ZVM4cURzbWQw?= =?utf-8?B?ak5XZlFjYStVVmczTnFEdDhLODVic3ZIRmRnQTArSjNVV3c2U0lHWUFkL3dU?= =?utf-8?B?bUVUSHJQZWE5cDR6bmVLbUVXeHdMVUdmVjNDeVZYQXhxTGtaUWl2M0ZkRUlv?= =?utf-8?B?RlNBbXFlWFF4NDNkdUxJK0QxTDBIclFDVmZVUzFncXFDVTNVamVuTTlNbS82?= =?utf-8?B?aUg3RG5tT0h6bS91Y3NnRlRURTlMY014cmVxVDZpVS9ycmdFNlF6Qy80Z3Bi?= =?utf-8?B?ZUlWa3E1dDBWbkU5bDI0Yk8vNjdBVlNwcE5XdDZjb3hhejRpcjBEL3hVSHJ3?= =?utf-8?B?enc1ZTlTWlZtRGI2TFJFQ3dPOTYvKytldkZDWk9aT0xyOGt0RTBac0lHOSs2?= =?utf-8?B?K1hsQ2xJUmlOaW51S0o5QUhFazhacFpQeHNXSjB6YTRtd2I5SHZDazdEU0hR?= =?utf-8?B?U3k3dWVYVVRjQVgvUXNmMjY2TitrYmVMVmRTMXVJSUM4YTFEZnk4dXdSQUZE?= =?utf-8?B?SGFpMmZhM2tsYmo1SjdScER3Z1cwTWVjS0R2MHE5VmlkaTlOTnpiQVB4eXJH?= =?utf-8?B?bzZ4azRNWnJnZUlrYklCOUlyQ1FFMEoxYXZHZnptTWNtSTd4QmRuZmJHc2xM?= =?utf-8?B?QnRVTU91QUhlaHQwdW50VVdqWTV1K0lBMjF0MWtHVEdjZmZFbzQyaXlzY3Jq?= =?utf-8?B?UnJrbEM1T2xpNHJoKzFOaHJPMFBtVDVIUzNodmd3T1d2U0E5LzZxbktQR25E?= =?utf-8?B?QjFaNzUrVFIwSkcwWit2RWJaMkVibnVhQlliZStzRTJZYlNod1F0Mis4TGlB?= =?utf-8?B?RFgwNXNiV3owVG51bGFIZU1IYXFiMmtSVTN3aisyS2tYdTE4TkhDeEVLbVpV?= =?utf-8?B?bzNnRHFYTkJFendOTVlMT25YN3MvODROYTJ6NndiajN3YkgxTU1DZlh4N1lk?= =?utf-8?B?YVFYRkhXdUYwUGVCYkEvdVhCdDVMZHB4SXUySytDUVhaZWxOL0lDYmV3bUta?= =?utf-8?B?UXJoQTB6SkJwREJVWVNlMWJNcDBhSnVTWERvSUF4bjV0SFVBM3VBaGFGc0hR?= =?utf-8?B?aWtTZy9tdGo3ZUZOdlZiQXd3cG5wNmtNTVFGQnVNSEIxenNvbUsxN3BJdkFF?= =?utf-8?Q?E4SoEXXUWrRsHqy4=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 55548633-d15e-4f88-4bfc-08df2ec782a5 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:30:53.5836 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dpo026Fevq6jxV4pK4k6zFjMDc0Gxp3wt/hK4k73ZA5W1jleZn7w/U9PgSTxXYdjS7kvcxVHlU+xxh2flCQUuOIALNi7uhqygwK2rcbdDJM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10683 From: "Tycho Andersen (AMD)" While working on savevm/loadvm for a new vfio device, I encountered the crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag for the vector, it would pass an unused vector down to vfio_cpr_load_vector_fd() which would crash. Fix this by checking the ->use flag along with the virq number to detect whether a vector is valid or not. Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 44 g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name); (gdb) bt (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79 at ../hw/vfio/pci.c:601 at ../hw/vfio/pci.c:597 at ../hw/vfio/pci.c:3088 at ../hw/vfio/migration.c:278 (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:971 (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:2654 (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130, errp@entry=0x555557157c10 ) at ../migration/savevm.c:2973 (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3058 (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3452 andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit f498c21b3595. Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI") Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Cédric Le Goater Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index fd73a0fdf87..5e281b2e1d9 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr) { const char *name = "kvm_interrupt"; - if (vector->virq < 0) { + if (!vector->use || vector->virq < 0) { return; } -- 2.47.1