> > The ASAN trace:
> > ==29798==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000050e8 at pc 0x560629814761 bp 0x7ffe916eb1e0 sp 0x7ffe916eb1d8
> > READ of size 8 at 0x60d0000050e8 thread T0
> > #0 0x560629814760 in virtio_gpu_ctrl_response /home/alxndr/Development/qemu/hw/display/virtio-gpu.c:181:42
> > #4 0x56062a8f1c96 in aio_bh_poll /home/alxndr/Development/qemu/util/async.c:164:13
> > #1 0x560629827730 in virtio_gpu_reset /home/alxndr/Development/qemu/hw/display/virtio-gpu.c:1160:9
So it looks like the bottom half accesses stuff released by reset.
Guess the reset should cancel any scheduled bh calls to avoid that ...
Hi,
> > The ASAN trace: gpu_ctrl_ response /home/alxndr/ Development/ qemu/hw/ display/ virtio- gpu.c:181: 42 Development/ qemu/util/ async.c: 164:13
> > ==29798==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000050e8 at pc 0x560629814761 bp 0x7ffe916eb1e0 sp 0x7ffe916eb1d8
> > READ of size 8 at 0x60d0000050e8 thread T0
> > #0 0x560629814760 in virtio_
> > #4 0x56062a8f1c96 in aio_bh_poll /home/alxndr/
> > #1 0x560629827730 in virtio_gpu_reset /home/alxndr/ Development/ qemu/hw/ display/ virtio- gpu.c:1160: 9
So it looks like the bottom half accesses stuff released by reset.
Guess the reset should cancel any scheduled bh calls to avoid that ...
Does the patch below help?
thanks,
Gerd
diff --git a/hw/display/ virtio- gpu.c b/hw/display/ virtio- gpu.c .18f0011b5a0a 100644 virtio- gpu.c virtio- gpu.c gpu_reset( VirtIODevice *vdev) gpu_simple_ resource *res, *tmp; gpu_ctrl_ command *cmd;
index 5f0dd7c15002.
--- a/hw/display/
+++ b/hw/display/
@@ -1144,6 +1144,9 @@ static void virtio_
struct virtio_
struct virtio_
+ qemu_bh_ cancel( g->ctrl_ bh); cancel( g->cursor_ bh); obj.use_ virgl_renderer) {
virtio_ gpu_virgl_ reset(g) ;
+ qemu_bh_
+
#ifdef CONFIG_VIRGL
if (g->parent_