From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021104.outbound.protection.outlook.com [52.101.65.104]) by lore.virtuozzo.com (Postfix) with ESMTPS id 6D5368105F for ; Fri, 30 Oct 2026 14:45:49 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dNHr34sPb9c0z8Za9HYXZQKS8DftEKMujnHV4mKuioaxO5OgeIU0lUHRzAdEY0G9y8JiYtWEOdUyZ9F411b7UiuqAeU9QNxMfUHsXy/V+sq+Bd/6tKVXw6pVhocVufeHL1nP7jYQHT9Kac7ag9SgDusJkOGDR4u8PaTSX3Ns5OetCzpkxOILQXYE0kP5x1FhPhqwBQ0blh/yKNu6gz56sFKGV6HfyP0ywPRhRRDgfJdwQKDqgOEKVVAUXG2J+M+lqdbkcQPGLFHJxaMx+O1rf7pY7bo2JUnIZFb7yozA91YWsA/vLf1oQIl+eesgXatIl+tP8AEqmnpZkhXZb60/bQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=YP0V4c9S7eIp0hDy7YJC2zh0xNqYIjJTftW/PEk3g9ipeoW9mpD/7c0TjXufALL4QFd3M5p5asJHSqy6tgqNYL4MajzffdEATrvGxoeuxaiRHqk9GDJ9OPb5uvqL0dlu5rKXpyylG0LjFowS62rb1Fu+oNMYyMd4wc8Rs7pFCc302sQTSiV93ggddo6N55QhUdCAKlPdGyvH9uNzJb2rLZKyI+GDnma2hihlaXgeqE6KAjb/SF7U35gt4XPjnyAbIF5wh17DzVTgWJ3KDvzLJLRb/Y8vgXK9knmeUHRgIlm5ECBJeJqwoDI5U8k71ppx5JbGRSu6ekatctzKDQkrOA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=vr6t5o39KZdJQGnWe5uXkz+2qzbJ/g8na4KrUzfhNWv/A0wfj8NN5WDoVliL1cWu8IeZXAY2MT8iJoUT9KlCZ0i3tXqNd8jDJN/qDSRIPkYxQEquqRclJBSWjXuI3xzqfKRTT5OD4ejrrXrmU8VVUztcoF4twiCT2xWeZANCDG7QMD36hQS1JSfED2aYArwn3KpimczSRC6bl2L7aAlSWXWWaXiG0jVb9QAPXm9VmvxtI1PdHElgNguR056pESzT5ky9zsxWkH4E8sZindVWKP7hQrEsejEdgGbdW1oIRRNSDz3UNRgkYjs6dKq7heUEonJvBe0W6lfU5aPN79syxQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by GV2PR08MB9373.eurprd08.prod.outlook.com (2603:10a6:150:da::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.12; Fri, 30 Oct 2026 14:45:45 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.008; Fri, 30 Oct 2026 14:45:44 +0000 From: Andrey Drobyshev Date: Fri, 30 Oct 2026 16:45:40 +0200 Subject: [PATCH QEMU HCI-8.1 v6 09/34] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261030-vfio_v1-v6-9-45de246bc92e@virtuozzo.com> References: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> In-Reply-To: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0502CA0031.eurprd05.prod.outlook.com (2603:10a6:803:1::44) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|GV2PR08MB9373:EE_ X-MS-Office365-Filtering-Correlation-Id: 5c545c43-f157-4232-f637-08df36947a0d X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|52116014|376014|260925021911599003|261026121527099003|261021123027099003|261022075727099003|261009223027099003|38350700014|56012099006|260925022911599003|260925021311599003|22082099003|10067099003|261021121427099003|18002099003|5113699003; X-Microsoft-Antispam-Message-Info: Sr/R++Reh2hTKR8zuYz7AWRm0WCAR7AlIK1S/SIijWTgRf/H2iiaa5R0dV2m0pC2RKWlLfTvfsLg0dzQ1ljh91ziO6aNqtpalddZVDL5cEWh58JwLygDyvRBC7Z92rYPy96nXH9Gj39bOzuSnomPG0a9MHHyKmyNxpJogErh8MUu01+iB0pByuOhmFS9H7Fv6kwCWZLPypHPNzKbIWsdr9kNd6CNLM+iSxfylfQrRWemFfEqoMbAA5V1ojedfGaTJ4Q2MQ/zWfdBclsMgceBNxujmF7R3Ox/MMKzq2Rq8xl0ZTRfvloLxBYd00Wu7q2vOOlbp1tyzXx66UqefQXzrvFzVdYj6AnQDx0dRSgszsTMDAoPBSu6vBfz0G/JHQnAhSNhvwvJ7WLlAcPlmbjbxbkPZgDTJo1ujs6zmmAlx8NJWGoFAdNoyw1caD1KvN1G3KXmYtJjojN5DUY37BEYy/KXiT8jmV1AnskM3IZuyMbeRBbJHakQ9Ohl08QPW1+y7OI191S7DEV8GjjLY0T4EghYplv9ndwjng6FeH7Lty2DY419gGnptQI0m4I0bOl/oK+zlQidxD/xiskmpa31qOeTruYeoNq6yTFJTZ8CkMb2XteF2hCjYy2KIioCYEHReFREa2hElo33pDiv2494q5UQ8LgfTe7jmwobU5fmUqk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(52116014)(376014)(260925021911599003)(261026121527099003)(261021123027099003)(261022075727099003)(261009223027099003)(38350700014)(56012099006)(260925022911599003)(260925021311599003)(22082099003)(10067099003)(261021121427099003)(18002099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UkhzbHZPUFR4REF4Y2dZc1NsMzM4WkFWTzduaExqR3o0UGR4ZUREajhNSS9q?= =?utf-8?B?c3ZJTWppUkwrcjdnVWlIUmRGRXhXRlRObDV5UkpKK0xiU2ZURlBmN24wT1ps?= =?utf-8?B?dlpMbkVSYytWQ1pWd1FDamxMb2pKQjVnM2JmeWljVjFRSkw5U3FKb3FaTEY0?= =?utf-8?B?N1hCeThmUjFEM2tEczdsQmpRYkkzL1RPN0FYSzNva2xZNEsyakVmUFR5c1o4?= =?utf-8?B?NG1QWmplcmtNTHlobjRUZ2x2OG8zTkkxVXNCYzB6MjVRQjJBMUg5RktFQmN1?= =?utf-8?B?WGIxS3h6cDVMWndoMnlkSUhkeUw5ZjZ3aW5zbkdsT1BHRHV3RFl4Q3VyVnhw?= =?utf-8?B?RFBxam5rSHE0bVRLK0R4WEZZeGlKczJpUE8reldHaVVENnhMdlFHdmRqTE5C?= =?utf-8?B?SGNTeW1oLzI4dkVJUm5OV3RwNmZVSmtkL3RkYkc4citxMEhCb2wwZUxmaUZr?= =?utf-8?B?Y0QyR2hscDQ5Vm1obkU3RTJZMVFBS01GMnlkbWphR1hqbUM5Wmhsdy8xakpx?= =?utf-8?B?S3dCSzk1ME9vWGdwV2VQc0dSR1lCNnRPZHJYNjZ5TTlsVjBPT05LSnFteWth?= =?utf-8?B?ZmJlMmJoc0x5TUJabXRINFNyRG1INTUvRFAwVWZDYnNqUDM2a3B4UUNoM3VU?= =?utf-8?B?TTRqUlg4Y1d0Yk05Nmh3QzNrZjJadTJxeE94cG1RUVA4VGRzcUlXRE9tU3pj?= =?utf-8?B?S2JrSkVvN1V3Q21jSjIvQlRlWkRtL1A5Y3lZWXZzaC9hWm5ZRWM0aElSaE5F?= =?utf-8?B?OVBWZHh3b0oxTStVZnBxenR3VUVFUlpKTVZ6QldzcFBMTENrQ1RaeXd3MEtp?= =?utf-8?B?dHd6d2xGRWZhd2FwMS92SHZWZFpqcGxucFEzU1hSYlVUV1hkUnpuQlF6ZEhn?= =?utf-8?B?UWwvQzVBLzZidVBFemVvYVkrVkt2Z09lWWRUd2ZtY3N2VENESG9EcEVnSkZt?= =?utf-8?B?YThPMlVScmIrNUVmVmFXdWlkQU9iaSsvbWhRZ2RwRGZNMWkweU9nZUp1WGNE?= =?utf-8?B?RnBIa28veSs0ZXNFb0h6N3cwOGs2TDNlQ0ZrYUZzV3BpRGNPc3l6aEhEeGtT?= =?utf-8?B?emFKbVR2ZjlnYlg4K1UrelN5Z3NLa3FFaTNpWjVwQm1CWEc4ZitraHlBZmtG?= =?utf-8?B?Z2NuR1BCYjBHY2ZiV21rNGJuV0FpZmtFSUMxREdMZ1BwYnhtMHJFTmhzaXVm?= =?utf-8?B?WUh5T1poeXNNdDJpQWFqV09BUUNTU3NwYmlzbkQvOWZ3NUkxanIzVk44ME56?= =?utf-8?B?bG5JNVdDREFoMm9STFA2ZU1BUXZiRHRnZUdoWUlUVWlxWEduVDdQV1JaTkNa?= =?utf-8?B?NEJDSFBKanVGR05FUkswRTlEV1VhZ1FjS3NBMzhsZzQ3N1k5NmlrZTFhb2Fq?= =?utf-8?B?NTZ5SVVRRThTZlErVGdRTEduV2xBWkxlSUVXbys0Wk8zSGJoTkd1dVZmUjRp?= =?utf-8?B?cjczTnExdXdlMk1rUkZUK2ExTHFkNVY5Nm9VMEJ4NDYzczQxYTFUclpuK2hD?= =?utf-8?B?OVBhZUhEZFdVV2RzM29DaW9aZFJkYTRYV1Rjb3ZjWmJ5STFub25TSVZVaVhH?= =?utf-8?B?Zm1mcEVZMW90c3ZhLzFLcnpZdFZqdjFNbEJrRllhTzVRMDZDVldHNHZtYnBE?= =?utf-8?B?bEhiY01iNXVLazRPQit0UnJTVWdTdnV0Uk5sSHl4czdHcEc2dFpWZmlweGlX?= =?utf-8?B?NGxMeEZzTUdaWDM2dlRTaTBXV1ZrNEJqbW5Ba1dDRW5mdlF3MG9hMitEZzFU?= =?utf-8?B?bjVTNUpIYk5LdWwvVzg3Ri9nQ2dNZkNyUE9BTy9EbXBnZnBVS1BwR1pPbi8w?= =?utf-8?B?ZENOa2o5K1o2MkdUK28wbCtHNEhydW9wNDdDelAwcUFHTWIrdHp6MWh5eTcy?= =?utf-8?B?TWJXLys0Y1gwclJtZTVlYmNyZnA4OW5Id0hmTDRnTHIwOXYxa0dpSEgrUlAx?= =?utf-8?B?OWRSSTJGdFg0UHYzY0VjRmZHRUxJMWZJVnJXMU9wZU5weG1iVDNYUHNCSXl0?= =?utf-8?B?TVV3Q0JnTDZraW5FdENiVTR4dHRqZVlMeFBlV1FpSzBDd2pJV3JiYTJYU1dt?= =?utf-8?B?aFhuOFQwUC9DVWMzTGZCU21VR1F4cjJQVFk5a0hKQXFQRVdscWNmNVNYTDgv?= =?utf-8?B?S25HZHJmS3UzNncvYkVCTUduRDFQNFFXVjJxZEloOUVqMHpuMGhWcHlQcm5K?= =?utf-8?B?UExEbUNwUnU3SCt0QjEvTHpDbTNTUVNTWk40MmY2OVhQdk92eSt2UXAwTjZv?= =?utf-8?B?UHFaOTVjU0NhdGtOSzNOUzFIVWV1V0EyV3l5RWhWNHY3SWFNdWFBNDdtRkgy?= =?utf-8?B?dGtKTUkzZ29vZGpjeDNub2tRQy9LS0lac3Q1QnVHc25vL3ptL1lqOGgyNEox?= =?utf-8?Q?mBunpaBqEscWD7V0=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5c545c43-f157-4232-f637-08df36947a0d X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 14:45:44.1983 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XKWivcmtCZs1zWkugRRr/Xmmhg+NqomZHfU9YjkMbLJ1vqQTkyEU3eZaThhhJN9gb0QwtYi0diENPNCsr75KDFxMlPOM0Z2ZHFPlo+RCjKQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR08MB9373 From: "Tycho Andersen (AMD)" While working on savevm/loadvm for a new vfio device, I encountered the crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag for the vector, it would pass an unused vector down to vfio_cpr_load_vector_fd() which would crash. Fix this by checking the ->use flag along with the virq number to detect whether a vector is valid or not. Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 44 g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name); (gdb) bt (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79 at ../hw/vfio/pci.c:601 at ../hw/vfio/pci.c:597 at ../hw/vfio/pci.c:3088 at ../hw/vfio/migration.c:278 (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:971 (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:2654 (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130, errp@entry=0x555557157c10 ) at ../migration/savevm.c:2973 (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3058 (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3452 andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit f498c21b3595. Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI") Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Cédric Le Goater Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index fd73a0fdf87..5e281b2e1d9 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr) { const char *name = "kvm_interrupt"; - if (vector->virq < 0) { + if (!vector->use || vector->virq < 0) { return; } -- 2.47.1