From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021114.outbound.protection.outlook.com [52.101.70.114]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1CD5E81230 for ; Tue, 3 Nov 2026 13:57:41 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=A4hqYQrc1mbR72TZWas3VpsMvDCGMV4B+u4ncq6pUwN1yIAzef6wlOp5X6RZWR0P1qnvAAAcEP0fFj8nDvUlwRn4Ng+zZWhvO14tVs+gcd2Z8m3/Z09W2u9u/yoV0w76XYExi0aY7vZNaYc3a+FzXHS+N6/WsEVxBKx3v+l4lYXTFUG+AZv0ilBhCY+vU0RqSGEn5fc7JqQkkAoDLlLYNStq69Cc28xIBu2rS/XonHPAjTpEKAmLXz+HxOKM4BiPotX/P3QoEXmPiu7LL8DAQXwH92QLo8Kz1qBLFXtsMtuf+v+z48OBde3MLK1lObjoWqBSugZLq+sngV0pOyuDjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=jMOiwYucFye5z+O2e1zJ+63xSQS93/wYZbcq+0qdyHfgoUmSZvutsjWQnAN+194RH98c6pv/GbcHOM15tqwkajf0A1xGIC6a1ThDMIv6zwWkygwfr9hb+z7qbUSfguMNE1qtEu4hBFTvAcIXxM0d8zXmwtpTGva7Hs8XYRBGX4nXIuDmpBn6LkYrRc+M0zFWax0eXilkKAn4TAiBR27DomSQ/1SfiA2Im80ZnpZtkNB6T7tqv4WcXJ5u3HtUkHT/hTO49/bXnLHEXOR7DoXdAoVTSYlL3MVC+MwqQX+PJbkdwuOrE4tWlmkUKExnNVAGzPAcclKVKjSpbgABt7qjpg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2UBFhClQyoP5TLYURVhBzGWOL09my4ahEchsY5coW6A=; b=hAKYBMGdQm2iisgOnD9UeFjEN+JXaObkQjmC4S5bYoksNjgGCpZsHetQQDIIvD4bNN0M5Rm7yW6FLjqkt3eHFKyoKy/T09DA9w6Wh5n6A2/OzHZw27YTnAWGnfTIq9VNad+JnZ0HaqlVBwgkT95g3MfVZBURq3Fk//yEe0GWOnlkMzWfqdeCnKcOqnWoVrUXIS8wHX02Oj/ad9dH4wYchp0LdzC0dSPK+QGOAsn8Kd7EAzMFjUV8IJ3hRzci6Ytm5H/Mx70kDBpYr55gpxHozuu29ZptfIDlPoFI3ymKTfUyyiOBoN12+z+HU8Mhv73Yx6M/g3ZC3ss25J4qqWxoqg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AM9PR08MB6115.eurprd08.prod.outlook.com (2603:10a6:20b:2df::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.8; Tue, 3 Nov 2026 13:57:39 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Tue, 3 Nov 2026 13:57:38 +0000 From: Andrey Drobyshev Date: Tue, 03 Nov 2026 15:57:25 +0200 Subject: [PATCH QEMU HCI-8.1 v7 10/35] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261103-vfio_v1-v7-10-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> In-Reply-To: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI4PEPF00000153.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::86f) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AM9PR08MB6115:EE_ X-MS-Office365-Filtering-Correlation-Id: 9d235506-5de4-4f1f-f4b1-08df39b265bf X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|52116014|376014|23010399003|1800799024|366016|5113699003|10067099003|22082099003|18002099003|56012099006|261022075727099003|261021123027099003|261021121427099003|261102123227099003|261026121527099003|261009223027099003|38350700014|260925022911599003|260925021311599003|260925021911599003; X-Microsoft-Antispam-Message-Info: uUclrf0IeabRzCOc254nS+2QIg62LMZKBDcZCPSGk69yeO+LAbKpTQTB7Vx1YSeD2rdniQ2GDZBKPy/AQ0ZaSYNDYtmceRyQLKyRBaiHddeCV0/toLQigRa5ZRz8cyzqY1U2ymaKLMZvhFQ4JZ0kcZz5Ol/wUsvTmrEmcBaanseI26m4meWWd6mIfNqIKutmagYaRC7dL4f2RWjOpxqqN4u4XYSQXnHe718lfvLCd2QLb0K9VUmtsLTGszWn9omW8ChzP/X8UA0VF7X/T+f7HsgpT3fhLxPnvr7AV0axFhKLZhPataD0IfL0tjTKJWblght2WurHZeQizDGwhawl8hrfS0HqQlrRTRPYPUkypkRDpHov+rQ66wce1lE60TKDgK5pQzO696eyEXuOC6E4nC36nIDNVYUlf3EK7GEMvM3PR4t2P9pOXJQfIvhDoBDGKz95kcaDJookGjqItg2eNVasrF5C8O7SSe3E3EgUHqbfyMPX4IZISfs++vhFvwv6QDg00kBjZDjGjEYxC2pS6BI6M+v6CBzXmSh+4B4sF6miYns030QtqzkgHSKRN1XjLBBgqCexEsd+pclvDPqUISHIHJ+Vn4ElCyARFPG7CefcU4jWFOQbowMdqmUo6ci2DWRJJwP354TtErApJMEs66gjMSkUkw8eOgPmokJbr+Wu93XnRhwLASDZ884FlzQO X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(52116014)(376014)(23010399003)(1800799024)(366016)(5113699003)(10067099003)(22082099003)(18002099003)(56012099006)(261022075727099003)(261021123027099003)(261021121427099003)(261102123227099003)(261026121527099003)(261009223027099003)(38350700014)(260925022911599003)(260925021311599003)(260925021911599003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VUUvb2xhZ25JVnptTVdDWGl4aDF4L21PWUt5bnliQk4zYVhEeHBhN24zajVW?= =?utf-8?B?dm53Q2F2dFpwM09aakZQaVEyeU9oYStRTDhoVVJqSGVmU1BGc25MNlhCUTlr?= =?utf-8?B?QlA4MG9SNzZMcmRTaHNNOGh3VmtDdFhORzBlOXJ0MzlFZlFHRzJrWHgydzBZ?= =?utf-8?B?LzJWVmg5Zms4UXd6a3ZhcDFZaXJ3NXVtNUlxKzlRLzR5OU82S2ZkVTI1MWNh?= =?utf-8?B?L0o2aDk4TlhWZ0RtbUJWd0Jja01aQys1V2NQZCtVSEcxYUxSZHRxb3Z2Zzh0?= =?utf-8?B?bkZlMXlMWDRhbGlkQ2p3SFBpSDl2RW9ycG5ac1oxaGpmZE5pQ1NZMmx2bmRC?= =?utf-8?B?ODhieWVNdVAvbENyRUFucjFNcTFSREQ3elZCSmd3YUlYTDRDem1ya3loOUFJ?= =?utf-8?B?c2l3WVRLcWZ5enJmVktBd093VDZ3Nk9rL3FKNFZhOEZtS01rRStYU0p0ZXI2?= =?utf-8?B?d3RIUHNQTE91K09jQlEyM2ZuK2l4WXozMi9UK05QNzFzTVhta2dDTGdyY0Rk?= =?utf-8?B?U08rVURSWDBMVnF6SGFLaGxsaVUxMXhYS3V4VUlESEV4akxOcEZmVngwQzBn?= =?utf-8?B?aWl5bWpiMEIwdHNkWTJQQ1BCNTV4UXNKcmpHNDVBUTlmVkk0WmF0UzM5RkI5?= =?utf-8?B?TTlxV3Z6Rm53WjJFQ1hLczJWM3ovUDBCbGlSZGN2eWg3U1ZBdnVpY3pxMFVU?= =?utf-8?B?VUxIZU1URDk1VjhXRHZIYXl0RklkeHhxcXhjSGREM0ZrT0xPZEx4QUpHcG9q?= =?utf-8?B?RmJNbzl6WEhQTzFRS3g5MmE2TUtaZmJsWTFSZkk1ZnQ5OU8zbFFON045SHhI?= =?utf-8?B?Yi9Ra3l3K0tDbjV0ZXFpM3RaR3F2K1NsVVdZNC92a2hTV2NwQzY3blhjcEVm?= =?utf-8?B?Snc0UTMzbnlnM2xvNUYrTE5zRXNFNVBGSXhrNzdzTE5ZRVN4NjAwd1NiemVn?= =?utf-8?B?UC8wQ0hIOHVXVzEwTXpGVGZKTHZIaHIyVG5EbzBMckVoUVVJOVU5R0lWOCt4?= =?utf-8?B?eFFMMGxmd1pMdEpmVVd3M2FUMFp5L0pIcmgzazZGdUFIa1JyVzlsMjMxTUVt?= =?utf-8?B?Y1JqME1mdGVZL1d0TnFnRWdmRFRJa01wT1Rnc3poam1tWGJTcG9XbHgwUVAy?= =?utf-8?B?UG5NMzljMHBQSU5aRkI0dU5VbmdOeERsRURGMTFYL0l0UXZrUzJSUm9RWlhj?= =?utf-8?B?bFk0WGgzbjJEeFBidk9HUWxxSWtRZ3R2ZVZOaUpDK0xXS2NORW5ibDdSS2pl?= =?utf-8?B?TWtaY2hiclZoU0JYbWVQS1hlaFgvS1ZMMGJ5SmM5cFFwaDM2WHNqWGN3N3g0?= =?utf-8?B?eXhZMEN5a1pPZEZhak9Oc2ZGL1FFUXRJZDJ2WS9kLys4VUJZYmIzSHJjME53?= =?utf-8?B?bFlUSTdRbWtJdUNvOTcxZUttbEo1bS8vVWVjdmVkcHQ0UDVrdjlLUWQ3a3A0?= =?utf-8?B?MytBR0lmNlN2Wm9Zd0U3ZUxvTUw1ZlVreUkzSnRwNWdWTTF0UW5qeUZjYzBI?= =?utf-8?B?YUhuOW9xbmFMY2NkRGpEaFdQTnBTRnpyVGZoNE1YN3VWZnBhYlRDZWZOZndr?= =?utf-8?B?UzRHWjZLSzlRdW5LbWQ0ZFNPTGdzTHdvelk3SGwxTURXd3U5MUYwemZmMEJU?= =?utf-8?B?RCtFalZjTDUyK3huNG1GeHFLdEZTVEMvNmcvc2wxdnd3ZVY3OXhKNlZzRWlG?= =?utf-8?B?RXZGZkd1eHdVbjFId3ZyclUvU3RFQWxpcHlocjJ5Y213Q2pGcFk2ZjAzTDBZ?= =?utf-8?B?U2NzWjdwU3NpbHVQZlZSTVNlWWFvTEEyeDhSTXBpUG91TkdoK3lBbGJSVjl0?= =?utf-8?B?dkZONG5SVUFtVWlsRkV3UjhydnVNTGlGczNjeGVOMUxlcTVXL3NEcjNPTGc5?= =?utf-8?B?K2JXQXdqb25WRDJmN1FGT1R4K2d0ZE1Xd2lDSkY5ZFB0NjNNZURaejgxM0h2?= =?utf-8?B?TWgrOGtyM011REd2Mnp1VFUzQnNkMmRNTTJFcXBNOXNXbjh3bEdiMVdZWHgz?= =?utf-8?B?c3VSWGpvY1k0OTU5MDEySHFZWHc0S0FDbm9UMWtHdVoxd2pHandwQzNXR1A2?= =?utf-8?B?bWhCeHFsQVVpUm5aVnV5ZlBWa2l0K2FLa3U3N2NPQUl4NElsQTk3NW9lQm0x?= =?utf-8?B?T01HM092eEtPYnpmK1BVVTRnOEJJeHllUlIwbDdVcnRZNk90aFVJbmUyTUNJ?= =?utf-8?B?cDE1MTNoVWdIMVgvL21IcEpxNVBTWU1RUVd5OVNnRldUc3V0ZUtGamZKakxX?= =?utf-8?B?RTY4Kzk2bWVKZTliNnppcis0MDY4djRWL0VDWkUzR1ZyLzFGdVlwVmVZcVUv?= =?utf-8?B?dkNTNkNkZ0lpSlhQdjNiNVZZalJneHFkL1J3ZXQ0eFlzOXUyazJBcWUrRzRE?= =?utf-8?Q?erIcVdWJc9z50n90=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9d235506-5de4-4f1f-f4b1-08df39b265bf X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 13:57:28.4986 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 9UGx7+083lNKNJ/cHkY3RIMyu8QeiLE8KAPVLfKv1vsZRopG5F9zsle0zlCSfaMt4negGybIt43nD27Hf2D6A9BuPfhEXD3zxUCs/GEbPnQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR08MB6115 From: "Tycho Andersen (AMD)" While working on savevm/loadvm for a new vfio device, I encountered the crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag for the vector, it would pass an unused vector down to vfio_cpr_load_vector_fd() which would crash. Fix this by checking the ->use flag along with the virq number to detect whether a vector is valid or not. Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 44 g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name); (gdb) bt (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44 (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79 at ../hw/vfio/pci.c:601 at ../hw/vfio/pci.c:597 at ../hw/vfio/pci.c:3088 at ../hw/vfio/migration.c:278 (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:971 (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130) at ../migration/savevm.c:2654 (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130, errp@entry=0x555557157c10 ) at ../migration/savevm.c:2973 (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3058 (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 ) at ../migration/savevm.c:3452 andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit f498c21b3595. Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI") Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Cédric Le Goater Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index fd73a0fdf87..5e281b2e1d9 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr) { const char *name = "kvm_interrupt"; - if (vector->virq < 0) { + if (!vector->use || vector->virq < 0) { return; } -- 2.47.1