From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021093.outbound.protection.outlook.com [52.101.70.93]) by lore.virtuozzo.com (Postfix) with ESMTPS id E0B9380A81 for ; Tue, 13 Oct 2026 15:28:11 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jB/B+OpEwSncVfzWN3qWpPu8hnVCL3W+dZjJkT7TSHwTGFfdk/OkPVP8OyDOGUSpTkLcz9RFxi1c/4LBZubp/4DdMIggosGuuZthjKmLq6QKjLU+Q9p1c+3M2f6spPQ0Ld7Y2j9c2JpmsHEHP6KRI0/+EJPKjklzig0Xm4lri4ISoeR8ef7L6QZ8k0CqmuD6C3Vq3CKcNNY10BqeTl6+m9p3f172B/k3hSzYoPorjkJFkisNKxcqgomwFAoBD/55PIx8sPWNiHAe52ma/Y0B0wWMpqIkMpopkwZ/URQhAhBmIJnFN2O6phm2JrDBNqkbjFWMgBonnOwzO5sDuBUfpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=hhe1QlbPkB5bLGDsNplBTTdufbZ9DidKmEhmL376dT2TBBEM1SVMXiAjL+5EVJwTLagUsMqPCHzhU9EQNIQlZLUlJEiBVzNfrn5nwa9tjfmIfB7cWf1DolAW5jZHC3Ye1Kk4d7AMwanxyBavA5K60AOJREuUZe92v63iUv7lWAkVDVR+XQn9Zee2kien+Vaw3Ui8lTHoEp/6No5SW+cj3ZDiE7zM9gRBSPtkKZpe1VxlMDEtHsHId+GvKgz+9utr0JW2DdKs4SvNQPYScgisEaNgihOFAo6pyhaE2zLH00biF4O38jDrZYovyyT6UlxH6oP8y+lYhLtRDvXrEeeczA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=cIS5vsh4QyMGjixU2t4wKN5W6RxQS1XTWWOP3VPKgLngOdYFxCvaAkyArH8BbgWX66ZOSSP2craQ85DJ7IaADr4DvlMsA4z6UW/QCZ3P1ZROX3NUirIZHkczjmOke7cf0wm/gA4Z2M30OSgwXIypAqGUnRtNFNvmt6FV+r7wkcX2Crr2ZWLR9+esvMLREM3pTZPlWst28LtDprzdbxRzR4OklKQAhxwZqk3sli6eoBQOSJMUMI+v0BMKr/LMJXK+3Tacwo3rW4hJ3aXIz5M1R7l2njLCr5iv8r7S3qLX/Xs8bU24o1vWKhe4CSiyidmfLfu+5ClePlJVN/T7Jucwug== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AM7PR08MB5448.eurprd08.prod.outlook.com (2603:10a6:20b:106::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.11; Tue, 13 Oct 2026 15:28:10 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0522.008; Tue, 13 Oct 2026 15:28:10 +0000 From: Andrey Drobyshev Date: Tue, 13 Oct 2026 18:28:06 +0300 Subject: [PATCH QEMU HCI-8.1 v2 02/24] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261013-vfio_v1-v2-2-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> In-Reply-To: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI5PEPF00000939.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::833) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AM7PR08MB5448:EE_ X-MS-Office365-Filtering-Correlation-Id: 82c08e87-5a0e-4650-d894-08df293e9626 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|52116014|376014|366016|260925021911599003|260925022911599003|260925021311599003|10067099003|261009223027099003|38350700014|5113699003|18002099003|22082099003|56012099006; X-Microsoft-Antispam-Message-Info: K6p6Ab47Jq9NoZnzk4VhoWzug/TAuWlJ6Eh5DPxo1Ss1sfFfhe6k8Jiy5D0Yca2y0420n5rIXPattfh+drf6J+7ecE9dsq+zXMFUKBoqNBZenes/wSsg1LO8RRTPUAS/0AAJmKdwUpY0FEsaUvXC+fyl54/9DxarPYzb2rxcfBibbHDdq9PGA+cNVqE8u24kOJ8vd3XqR2C6lAru2ibtETuYZ4QB7FHmhZhW7cR3VPeeBBCB6zPKw4JR9FrvRzWtA4Fir3U83mFd1zhxD+ol8epHuqSvT8OYuDVtUEpE3DPb2749QWf8uNZN46jEVtrMNuY2R6iGvTMmDaCSw1phNwA3lrr+4Bfx5kcGaMfIHm1aLIwXVfZ+MMySbmXh+vrRzDcC/NnyFHG+mySJkwFgTG4DGZxL7raQifpAJKWrXSLcMSeF/zMEq4OrjdUy6p+eGWSGeKCfBvpBD4xOifw/YDgTDPtmLkVTXu62Rc9sDxRPa5QGBk3V75GUm1enRcAL4ER1p6kcQLwloT1JeFUsjh/MbVhLRIYyyWMUjx7dlM9tG1QMt8oHVliu51VL0bT3Rq1KkcR8xcyTuhuqeM7GxI9oq2rhgYXy1OtGy9VWdhqqwOKQjbfQL+Pd7NvMvnaEbsPT4QI1cas6ww/yltfs1dMmJSNg8EH5Oqu8vW33wrc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(52116014)(376014)(366016)(260925021911599003)(260925022911599003)(260925021311599003)(10067099003)(261009223027099003)(38350700014)(5113699003)(18002099003)(22082099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Zjk0VC83UmUvT25waHo4ejBXU3RrbXMxTkNEck5sdFR2WHlnYUR5dnhBTVh5?= =?utf-8?B?RHN4ZU02Z0JPck5KR3FvNCtkTHR1UURrS3g3NEgxMGNBWWpUWUZwUEZLQnY5?= =?utf-8?B?T2s3RmxwbVVkYjZyUEE2clNpRUdEaG9HQVdlRkIvY0VKM245c2ZSNWU4dDVT?= =?utf-8?B?QnZYamRrSDhlNTVUdEUxRVRHUkorM055T05XMmQweVVGallWTi9vK2lRc3Bm?= =?utf-8?B?am9PYXR4WjhHVkxqZ09sMC9vV1kybmZtYWJ5ZEJMdTd5MmN5cEF5R3gvSHZX?= =?utf-8?B?N1UrTkptVlV2UDZkY2ZsdUdydjFJSnBrY0VQTnRMb3QybWd5K3RZMVBpZFVD?= =?utf-8?B?ZEhWT0tuTlFVYXA5VWU0WUZFYTllTXpaeW9NdHhhbTBHbFJwYUtzMzR0ZGhy?= =?utf-8?B?eUJZaVluN2g0bWI2N2kwU01tMllja1VxRDBDUmlHWDJBNnJoaTVFdXUzQ3BM?= =?utf-8?B?V2VOUzcxSGhYdUQrMlBzTUgwQXBqeExoMkJaNTVpSVAwS0ovMmlSWGp6S1N4?= =?utf-8?B?TlZ6bkhmcGJhT0k0WUZ3N3FBMU9lUkFIcmo1d3ZWbjVISjBQbTZ5TFR3NnNM?= =?utf-8?B?cUQ3OGxpN0lVQkFQQVU5am9ObXR2dDFNc3NNRWpCS2FiY1VYQmdyM2x6bDIw?= =?utf-8?B?MWxtZkF0TTBTRlZlUjc5azIxa3J3c1ZjL2piWXIvbFVTK3g1OUZ1d0k3ZTQw?= =?utf-8?B?UzhnR0JNMkhFVHkxZURKMVF1S1AxaFlQdHowallOZHA2dHhpbGhTakE3RlFj?= =?utf-8?B?a2pSRmdUZFZGa3FCbjZaam9NVVZsY3RtMkVjWjlTa2Flakg1QmIvTURsenRy?= =?utf-8?B?bUtRc3RtMThKNWhkTURwSHdRZEFNTjNGL2tIZlVSTUFuazYvTTU4MGxKNjB0?= =?utf-8?B?OWhWOHRnSk9UNTdFS3A4SURhQ1VkaU1naDNRMi9ka05NeXVjL2tDc0pXU3NO?= =?utf-8?B?TzJ0SHBpYzZRVjdPOElGL2tFMzE1dHNaeTlVOThTeUZCRXRidXNXdWNqemVQ?= =?utf-8?B?RjRCeWVENVVEUmtGd0lVVnU2dW53RUg5WDkvVFI0L2lEdUNUbnpqbVU4ZUs2?= =?utf-8?B?NjBpbUk5dS9VY1BmaWFreUJJUXRxemY4VzQvMjNYbUsrbDU3R0JlR3d4V0lk?= =?utf-8?B?cll1VkIyVHllby9RYXAzUUJ0NlJUNTRHK1hMQzV4UWQzNm1EVWhqbmRMRkJh?= =?utf-8?B?MkV1NUMycjhBRFhoaXo4YW54VSsyanF3K2sweXhlc2pzQWtVZHpuTm5XTXBO?= =?utf-8?B?UWlBZHFzYlBzc3BtemIzanVmUkdsc1YxV2loVzUvL2hjV2dBVEVKSHl5MUFh?= =?utf-8?B?aEZnRUVjVDFNZFA5V3ErSUxmZ1dLYkNJQlIzN0JEZ0JFTk53N1IwQnhjQzVS?= =?utf-8?B?UTJSWHZIbmNCbjhkR3FvQmdrYXBJTmhqazM1V3dGT1BUM2duWTlYblJEcnA4?= =?utf-8?B?R0ZNbzY2U2xQTGgwVFF2WjBNOXMya3kvSmJnK0c5QTU4RmF2YzZaeEZ4VmNU?= =?utf-8?B?ZXFlVlFob2trcEZKMk9pR1l3RnV3bm4zejZ5QUM0K2lGanhQTFNUY0QrWklR?= =?utf-8?B?ZWhxZXl1QlRMSnhMNElHQWhrZjhrUTFLZ3ZtRmZxaWJlOG1Ja05lc3liV1pp?= =?utf-8?B?ekpaMkxJMzhnYnd0dVZlN1pVN0FXS3ZWRFVNTEFqbHFWVVl0VUtJa0MwN2Fr?= =?utf-8?B?SHZvTi9weXlwQlRmN3pYRld2akFZMnFac3Y5YkY1UHVWbEVXRm9wQWVZN2li?= =?utf-8?B?VTVEejV2TFdITDNJZjU0YmR0d0hxZWFxamV2ZlB6WlBMN1dCZGF2dXpqMkF1?= =?utf-8?B?YjBNbmlOYUhSRjNIZjBGakErMEZDV0dZVHowTEpleGwyWm44SStqNU5Zd3Bz?= =?utf-8?B?bThlaUppRk1hN3hpSlpwb1p2TlFRdkFRY0hhZHpzWkFVU1B0VXdvUjNTcmtS?= =?utf-8?B?Wll4RENINjFNdk1oOVVlYWw2UVBCcGpiYnBBTjN0dmVCYit3V0I3UkpFaGdj?= =?utf-8?B?MzN0cS9zMlpjcjJhdXNiQndRTHh5Ym0zRG5OWHRZRFJCS0RKSEpvM1JjUldE?= =?utf-8?B?Z1d4WTNmbTB0MEhZc1dmZ3MrL1RxejJWaXpock9EaHlPOFJybmd2R084c0k4?= =?utf-8?B?MFVpWnlPUmhtRVhqYkJSRStoc0FWRzF6WndTL1l2cXNsRHRwOGZFSFBsd21D?= =?utf-8?B?SzdLeEsrNmhNU3pQb2NKTGMyb1pGSXY5dzV0aVlxL3doU0VBMmptUmNOSlBZ?= =?utf-8?B?dE10WmwvQ0c0bUhycWR0TWM2aVRVaU9RVnl5aFBBNGkxdmFBT2VsMVpYSm5m?= =?utf-8?B?ck1LTzlFV2M1RUpRZnlNYVI2L2NFNE04bHd0STJseTM1UGtVVkNZQ0M0NmlW?= =?utf-8?Q?dt21rmM3dxQL2mVY=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 82c08e87-5a0e-4650-d894-08df293e9626 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:28:09.5056 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hmagTNNKxLNWeimDHfcfcz95it4KTLt9gUrENVAIBfsawR1gHoWZ9AmExw9s46Iqp+txGQYUQUMrA7wbHIr9uqJG2SjKPiELGT8pu8Z9fyI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR08MB5448 From: "Tycho Andersen (AMD)" While working on savevm/loadvm for a new vfio device, I encountered the crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag for the vector, it would pass an unused vector down to vfio_cpr_load_vector_fd() which would crash. Fix this by checking the ->use flag along with the virq number to detect whether a vector is valid or not. Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 44 g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name); (gdb) bt (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79 at ../hw/vfio/pci.c:601 at ../hw/vfio/pci.c:597 at ../hw/vfio/pci.c:3088 at ../hw/vfio/migration.c:278 (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:971 (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:2654 (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130, errp@entry=0x555557157c10 ) at ../migration/savevm.c:2973 (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3058 (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3452 andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit f498c21b3595. Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI") Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Cédric Le Goater Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index fd73a0fdf87..5e281b2e1d9 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr) { const char *name = "kvm_interrupt"; - if (vector->virq < 0) { + if (!vector->use || vector->virq < 0) { return; } -- 2.47.1