From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020085.outbound.protection.outlook.com [52.101.84.85]) by lore.virtuozzo.com (Postfix) with ESMTPS id 28D138109C for ; Mon, 2 Nov 2026 10:36:30 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iDr6kubwo76fXVK7xzvao4BlQvs1saW5XD6t1uflCMdWwk1xhsQ1cymHWpjYfzuMAOy2J4wdjxdGd/KduXCY34MywzT0pZuGN2OYdgKyqrgg9GAvDIPKzguABLE2Cg0pxNDDr3Kb7s1+eJsXdRYlfzqFEr93NKfHF+2H5DGClxu5oZXh/b20ntAKLTqX7PDJ4pUAR2TJlLtYh64ZQsdjqwl9/rZSEbyStDqCjOyE1FwsfPwytBxVUMo1n7/L0QxRDtlkjxJw8SrL/8qnzSwebdxt5XSZeYWqKI8KsABdLuTvrb7CUoF/iReBYdENat7XBdHGnrj2eMhV1zXH9MIiZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=mkCYNt3Zfzs0kGIvqf65KiqOoquOa94QEfSdwFaJzKPJYhvZUxcEXrWJmuyE2aQrK67Doc5ZXAAqn8QjVzUGwbl3A3WaJLf/RcO5m23smO+diCWKVxQgMmvEv7/PwY3Y8RPOSMsKlhC1KoetOjqvG2E2OcqJ7xEBOh0CQAvfpILr1zq3qhaBmKBvRW05c2ls2uB3kbrlNvaKf2RHLSpdaKFYL+LbsVT/ggsAMK87b7N9RXk3fYYFMYF1X1cYdgxafGXPaocfg/zrNH3jfCeRvRkXXKIYGMSy9mnw//lUxpN2WnYfRdgC/6AznT0mLsqShveTE8uYVPlOW09h1mpvxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=DmrW4R3C8/hkE90A/KfcmfbWETmqd1piPUOjg42+x29EgYZx2sO6CHNK76hxYQVTK76Wc/Ra5Bd7NpTI+NMWO5dd4NILBdexDd/xiNbxPHeG+Cf91GfQsVVUmoL1AQHtyxYNIw8hP0GtdDK4dKhB8bA3Ylsod3IILEajomVrqOm0qcjciAQCQNGHjtrGWDDx3UgUFBN1z31TgnqrmmhS80g8EFvHhjp+U3W7qMtpCrzyPNZXqyjSL1KnS0Iz76pYIrnj1sUYfxNuXqHff3LL5UTj57nz6U4BtI4Z7PrA+uCeAbHJ3w3yc5keVVEoL6Om3veFeSlIlGydoc1HEFlIwQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB4PR08MB8199.eurprd08.prod.outlook.com (2603:10a6:10:381::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 10:36:26 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 10:36:25 +0000 From: Andrey Drobyshev Date: Mon, 02 Nov 2026 12:36:24 +0200 Subject: [PATCH QEMU HCI-8.1 v6 09/34] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261102-vfio_v1-v6-9-9bc7cabc850d@virtuozzo.com> References: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> In-Reply-To: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIVP296CA0048.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:353::18) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB4PR08MB8199:EE_ X-MS-Office365-Filtering-Correlation-Id: 594567a8-7712-4020-dd50-08df38cd24eb X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|52116014|376014|38350700014|260925021911599003|260925022911599003|260925021311599003|56012099006|261009223027099003|261021123027099003|261026121527099003|261021121427099003|261022075727099003|10067099003|18002099003|22082099003|5113699003; X-Microsoft-Antispam-Message-Info: tzqcGzsZ2FQBcLYTip0Doeh/F9GvcnJVFYqfG3xPebuU3WYWDc3M1wWR3r9W8B2LuMromi9kDREs22QkMHRpwFWWzJF0s/yMiR03952vbQLEZf2qPZs3XcqCSfzidBzJDJLIwl210lOOp7SasG2EmCMXGAAsHaaKJjxAJdGKEgzBKHC2HI0A4pkDvPyX4g2FKIFpwYmI0uRc/0F8yYaHoroRaFyc4nMAthfPezzxZ0SSPeHyorzwpMQFCn9mlFm3y2OBudLHug+VHvlBa6GT7kbqoh1sNMm7tE1UhlN/8IK15E9sZULpv3h269+uk2VzG/oqYGU26DL8NG+S1N22AfylSswy5xkdAoYhjigL66VgIiMq0foADUihqemj5PbDmDKhIrTxgQNybukxZTck3QJEPiCsUtKHrl8yZd75Q1lOg7rtYgnUaUa3HaiHm3JA/IR6v9OfxOxeCjr01g5aGSf+odejiACY+DFFAtZhOqyH27nOqFNucp203smNcp3CPOi26Uyh4KZGEWmlV9sTp44i0WZaHfzIeDYz7O1q6bnoh0WB9PQYNvaIfk6cLkYBQerE/ZaAMOBCoHTR1dQUfKh2AFiGzbt9Qey6VZx/+sMjn7leFSD0NRTopiiUu2CBRfFWZ+Al9XBZs5BD2aBpKnnzoVEY/niI6RpjV1uUQwQyPB7Psdag3hACtLsdQMq2 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(52116014)(376014)(38350700014)(260925021911599003)(260925022911599003)(260925021311599003)(56012099006)(261009223027099003)(261021123027099003)(261026121527099003)(261021121427099003)(261022075727099003)(10067099003)(18002099003)(22082099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?akYvdzZUSi9od0tFRWZ3SDRUbDVKbkhHV0hzVHpzdHQ2QWJsME5pbWVNM3Yw?= =?utf-8?B?a3kxZFpnbkJ5M3QzeXFVMXoyamZ3Q0ZyMllUQ1RqWFlGT2Y4MDgwVk42VXlM?= =?utf-8?B?SFpwQkN4Vjd0UVlKdW5HT2l1SHUxQlFXbHlpNFFGUC9OWHJFSUtCS2d2NkZJ?= =?utf-8?B?dTNkTEhvRFMzOHVJRmV5enAzU3lMSnp1ZEJTYTVHekR0emhDN0tNa2syS2VZ?= =?utf-8?B?ZU4rSGJhVjNoT1BsdnpDUmtrMTNTcUV4UDVtZzlYNkYrbUJ3MVpucGpXYThp?= =?utf-8?B?cE9NWlhBdWE1MEFpL3hSNG16NXpkeFBZWWRGT2NLSEdKcXBwbUk5U09KenlB?= =?utf-8?B?Yit5cWFjRTdFL3A1bmw3M054anU0Sk9KZzZ2MXJEejZCWkx6amlocE51NEcy?= =?utf-8?B?WVVSZElhZ3Bsd3AydDNsalovTXJYSzdHbWRaOGlMVmsreWFHNzBkM01KdVNE?= =?utf-8?B?a1NjeENtZ0FUMlpUOWFXV2EvTW1lM2Fpd1lyTFNmVUl2NVQ1M2hyZjRyZHh6?= =?utf-8?B?WVBnZG9pNnBVeUJ4R0tiZ2NkYUMxdEh0YkMzYzFEd2syUTNlSTZGR0NQSVVt?= =?utf-8?B?Vjl5QzF1ZEVBbUN1U2RNQTAxMStQV1ZoaE9VK0ZleTNIbnNhZXhoaGhhMHRL?= =?utf-8?B?RHVyTUZCQy8yM0ZSd0hKWittcVJSc0RtVHhZc21TL2hoVnY2ZUxQZzZudnEx?= =?utf-8?B?ZktjQmk2cHBGNnU0ejF1MVFXdEk5UW5KdVlNamtRYklqNUk4WWxCOWZSR2M3?= =?utf-8?B?c21Gb0wwTnBIdWYvVGdGbDlIRVBheThzb2JRRTMvNFNtR0tJYnFCcFJHaDZk?= =?utf-8?B?MFhTUjRaN2s0ZkNNS0l3cHlJUGxoWFhnZit1aGdzZDJ0SzdtaGpBVU5UT1F1?= =?utf-8?B?MzJ6VkgwTm9rZTJzaVphTVNFWE1vR1VIK1dac3Byb2FjUE8yTG9Cb3JIQkhR?= =?utf-8?B?eEJ5eW9tQzh4alJreGlCMnVGUTJtcHJZUHJ4REpmNDNieXprWDA2cTMwMzBF?= =?utf-8?B?eWp1bGtxUllISHpiNFU3QW9vRWdJYnEyOVpQcDNzeTdCUHJ6QkFRRGUwNm1j?= =?utf-8?B?RTQ1Q3RhMXZZbjE4SzdoeU9WZGo5OU5OdGJyZ3ZxOGhQcVkxV3o4aVRQK2gx?= =?utf-8?B?U1FXZ0xLRDRnUFhpdGthZi92YWtxZ3BBMGJkM1c2bXNnYWY0V3hBYmI3Y1Na?= =?utf-8?B?YUxWTUdKNGtIRVJJQmp0SEtHY3B3YWdkaFRXdjdaY2hCYm9DMUZ3dGhYOFI5?= =?utf-8?B?YXlITDJNbGdpVWkwZzl2dS82TDZkcHZ0d04rUTA5NmFsWmIxL1NGSUNwelVj?= =?utf-8?B?WHp0U0p2WHd6SzJzMjZhRmdDZ2pTdWZ5UlM0eXZVYVVoSVUydVlzZDRlR0xR?= =?utf-8?B?STlNcTVsa2VFUDNLS0doOURyWkJSZTFqT1hmNmlWYVJxaG5UYlkvc2d1V1BZ?= =?utf-8?B?VUxiSFFmR2ptclprdk43ZnIwOVNGNm9JQ1EwMXNqRE5XRENrc2k5NG9YOGV0?= =?utf-8?B?SjRTRC9Zcm4wajF4YTJGSVc5cVcxN2RuMEhwVjZUM2lWSkdVSDhqYVNNQUxW?= =?utf-8?B?djA5SkR1UTVPQzI4Z2tTc2psOU1oZjl4T1Q5SFJYSWtDZ1g2UTQrb1p1NnV4?= =?utf-8?B?SDR1d0JQVVJPQ0pFY1gyZHdnWndqVmJZNTlSb0ZXUm1qN3FmZXBKS3IyQkoy?= =?utf-8?B?UEhzczlWZjh6b29uYlkxNlIvckJJY1RzblorSFYrd1cvRnBaUG9tckpMSUFI?= =?utf-8?B?OFZwcEMrRkQ3cnlKNUgxaEZFRkhNLzBiVkp1ZTV6Ujc5aFFsYyttRWZFaWht?= =?utf-8?B?WGxFTlhqd1pHVWx1NHBkMXc4WmZYbGt5dERSdjc1TmVTQlR5ay9PTktCRUd0?= =?utf-8?B?R05rb3l3VENDYVByNlNOK1hDblgyaXByc21iaXV3Skx1OHdxSXJ5anphNERQ?= =?utf-8?B?LzJqNEkyUmtlQUo5cTU4UGlMWXVyRnFFQ0Z0SGdjUGU5QzFHSVZ5QXBYL2pD?= =?utf-8?B?WC9qZHlFczdFenhrMitMT3lNNVprQ25INXB1aEpCZTk5UE1LYjRSamlaRUFC?= =?utf-8?B?NWllNndsR3Y1c3A3SjY2cTlvTXBNeEthN2VMcC9iTGxjTC9kRkJCSmU4NGhO?= =?utf-8?B?OGRsYnQrcWxRRmxDYWQ2OUIyN014dG00TGFhNHNBTGVnMktneWNpV0RzSHp3?= =?utf-8?B?bUFzaHAvazBwRXlLMnI1c3cxL05mb1IzcHN0am0rS0JjVG5vcThXOCtzUC9L?= =?utf-8?B?cFZ2eUVaSXFUYkFaNGNEVHVFVmgxVVRJQ1hmSDJtYmdnVFFuQk4vTHJmOXRR?= =?utf-8?B?NGRuVHRjOWhwKzd3K25DNlUxZ0FPbHdwcCtBN0ZkYkRlTGZPMlZJb0JEbEF1?= =?utf-8?Q?aZQm0AqqjBZr/+Xw=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 594567a8-7712-4020-dd50-08df38cd24eb X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 10:36:25.3058 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FYgaIHAgXnxKPeCQZK52OeYB/FOZBXFvNFDTbUoxsxEdoTFaffm8d81Kc1YnInfd8mtdyjtD6DlKwwM707dk5WWkD+lEmP4Nt+ibFXiEEqI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB8199 From: "Tycho Andersen (AMD)" While working on savevm/loadvm for a new vfio device, I encountered the crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag for the vector, it would pass an unused vector down to vfio_cpr_load_vector_fd() which would crash. Fix this by checking the ->use flag along with the virq number to detect whether a vector is valid or not. Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 44 g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name); (gdb) bt (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79 at ../hw/vfio/pci.c:601 at ../hw/vfio/pci.c:597 at ../hw/vfio/pci.c:3088 at ../hw/vfio/migration.c:278 (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:971 (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:2654 (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130, errp@entry=0x555557157c10 ) at ../migration/savevm.c:2973 (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3058 (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3452 andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit f498c21b3595. Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI") Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Cédric Le Goater Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index fd73a0fdf87..5e281b2e1d9 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr) { const char *name = "kvm_interrupt"; - if (vector->virq < 0) { + if (!vector->use || vector->virq < 0) { return; } -- 2.47.1