qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions


From: Laurent Vivier
Subject: Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
Date: Thu, 7 Jan 2021 09:02:42 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0

Hi,

any comment?

Thanks,
Laurent

Le 20/12/2020 à 17:35, Laurent Vivier a écrit :
> In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
> since
> commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host 
> visible region")
> but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
> get the address and the length of the region.
> 
> commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
> 
> As this is not implemented in QEMU, address and length are 0 and passed
> as is to devm_request_mem_region() that triggers a crash:
> 
>   [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
>   Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
> 
> According to the comments in the kernel, a non existent shared region
> has a length of (u64)-1.
> 
> This is what we return now with this patch to disable the region.
> 
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> ---
>  hw/virtio/virtio-mmio.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
> index e1b5c3b81e37..610661d6a526 100644
> --- a/hw/virtio/virtio-mmio.c
> +++ b/hw/virtio/virtio-mmio.c
> @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr 
> offset, unsigned size)
>              return 0;
>          }
>          return vdev->generation;
> +   case VIRTIO_MMIO_SHM_LEN_LOW:
> +   case VIRTIO_MMIO_SHM_LEN_HIGH:
> +        /*
> +         * VIRTIO_MMIO_SHM_SEL is unimplemented
> +         * according to the linux driver, if region length is -1
> +         * the shared memory doesn't exist
> +         */
> +        return -1;
>      case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
>      case VIRTIO_MMIO_DRIVER_FEATURES:
>      case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
> 




reply via email to

[Prev in Thread] Current Thread [Next in Thread]