Re: [PATCH QEMU HCI-8.1 v2 16/24] kvm: fix coalesced MMIO flush racing with kvm_close()

[no-reply@sashiko.virtuozzo.com]

> kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the
> coalesced MMIO ring lives in the kvm_run area of the first vCPU.  Nothing
> stops the RCU thread from flushing that ring at the same time: finalizing
> a memory region of a freed flatview calls memory_region_transaction_begin()
> and thus kvm_flush_coalesced_mmio_buffer().  kvm_state is still set at
> that point, so the flush reads the ring after it has been unmapped:
> 
>   #0  kvm_flush_coalesced_mmio_buffer   accel/kvm/kvm-all.c
>   #1  qemu_flush_coalesced_mmio_buffer
>   #2  memory_region_transaction_begin
>   #3  memory_region_finalize
>   ...
>   #10 flatview_destroy
>   #11 call_rcu_thread
> 
> while the main thread is in:
> 
>   kvm_close -> cpu_remove_sync
>   vfio_kvm_device_close
>   vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE)
> 
> Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with
> a VFIO device.
> 
> Clear the ring pointer first, so that new flushes skip it, and wait for
> the pending RCU callbacks before destroying the vCPUs.
> 
> Fixes: 7ed0919119b0 ("migration: close kvm after cpr")
> Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com?part=16