qemu 2.5.0 ivshmem segfault with msi=off option
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Launching qemu with "-device ivshmem,
Causes segfault because, s->msi_vectors is not initialized and s->msi_vectors == 0.
Does ivshmem exactly need this line ? :
s->msi_
It makes no sence for me.
Subject: [PATCH] fixed ivshmem empty msi vector on msi=off segfault
---
hw/misc/ivshmem.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index f73f0c2..2087d5e 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -359,8 +359,6 @@ static CharDriverState* create_
int eventfd = event_notifier_
CharDriver
- s->msi_
-
chr = qemu_chr_
if (chr == NULL) {
@@ -1038,10 +1036,11 @@ static void pci_ivshmem_
}
if (ivshmem_
- msix_uninit_
+ msix_uninit_
}
-
- g_free(
+
+ if(s->msi_vectors)
+ g_free(
}
static bool test_msix(void *opaque, int version_id)
--
2.3.6
On 12/29/2015 06:38 AM, maquefel wrote: chardev= ivshmemid, msi=off -chardev path=/tmp/ ivshmem_ socket, id=ivshmemid" vectors[ vector] .pdev = pdev;
> Public bug reported:
>
> Launching qemu with "-device ivshmem,
> socket,
>
> Causes segfault because, s->msi_vectors is not initialized and
> s->msi_vectors == 0.
>
> Does ivshmem exactly need this line ? :
>
> s->msi_
>
> It makes no sence for me.
>
> Subject: [PATCH] fixed ivshmem empty msi vector on msi=off segfault
Patches require a Signed-off-by: line before they can be applied.
> eventfd_ chr_device( void * opaque, EventNotifier * get_fd( n); vectors[ vector] .pdev = pdev;
> ---
> hw/misc/ivshmem.c | 9 ++++-----
> 1 file changed, 4 insertions(+), 5 deletions(-)
>
> diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
> index f73f0c2..2087d5e 100644
> --- a/hw/misc/ivshmem.c
> +++ b/hw/misc/ivshmem.c
> @@ -359,8 +359,6 @@ static CharDriverState* create_
> int eventfd = event_notifier_
> CharDriverState *chr;
>
> - s->msi_
> -
This avoids the segfault, but it may break other uses. Are you sure you vectors[ vector] )' conditional?
don't need an 'if (s->msi_
> chr = qemu_chr_ open_eventfd( eventfd) ; exit(PCIDevice *dev) has_feature( s, IVSHMEM_MSI)) { exclusive_ bar(dev) ; exclusive_ bar(dev) ;
>
> if (chr == NULL) {
> @@ -1038,10 +1036,11 @@ static void pci_ivshmem_
> }
>
> if (ivshmem_
> - msix_uninit_
> + msix_uninit_
I can't see what's changing here. Whitespace?
> } s->msi_ vectors) ; s->msi_ vectors) ;
> -
> - g_free(
> +
> + if(s->msi_vectors)
> + g_free(
This hunk is bogus. g_free(NULL) already works properly.
-- libvirt. org
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://