search for: juzhang

...rt is open, a subsequent close() call on the port accesses vqs to free up buffers. This can lead to a crash. The buffers are already freed up as a result of the call to unplug_ports() from virtcons_remove(). The fix is to simply not access vq information if port->portdev is NULL. Reported-by: juzhang <juzhang at redhat.com> CC: stable at kernel.org Signed-off-by: Amit Shah <amit.shah at redhat.com> Signed-off-by: Rusty Russell <rusty at rustcorp.com.au> --- drivers/char/virtio_console.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/char/virtio_console...

...ticed by hot-unplugging a virtio console port and then plugging in a new one on the same number (re-using the vqs which were just 'disowned'). qemu reported 'Guest moved used index from 0 to 256' when any IO was attempted on the new port. CC: stable at kernel.org Reported-by: juzhang <juzhang at redhat.com> Signed-off-by: Amit Shah <amit.shah at redhat.com> --- drivers/virtio/virtio_ring.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index cc2f73e..b0043fb 100644 --- a/drivers/v...

...rt is open, a subsequent close() call on the port accesses vqs to free up buffers. This can lead to a crash. The buffers are already freed up as a result of the call to unplug_ports() from virtcons_remove(). The fix is to simply not access vq information if port->portdev is NULL. Reported-by: juzhang <juzhang at redhat.com> CC: stable at kernel.org Signed-off-by: Amit Shah <amit.shah at redhat.com> Signed-off-by: Rusty Russell <rusty at rustcorp.com.au> --- drivers/char/virtio_console.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/char/virtio_console...

...ticed by hot-unplugging a virtio console port and then plugging in a new one on the same number (re-using the vqs which were just 'disowned'). qemu reported 'Guest moved used index from 0 to 256' when any IO was attempted on the new port. CC: stable at kernel.org Reported-by: juzhang <juzhang at redhat.com> Signed-off-by: Amit Shah <amit.shah at redhat.com> --- drivers/virtio/virtio_ring.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index cc2f73e..b0043fb 100644 --- a/drivers/v...

On Tue, Apr 17, 2018 at 05:04:59PM +0300, Michael S. Tsirkin wrote: > On Tue, Apr 17, 2018 at 08:47:16PM +0800, Tiwei Bie wrote: > > On Tue, Apr 17, 2018 at 03:17:41PM +0300, Michael S. Tsirkin wrote: > > > On Tue, Apr 17, 2018 at 10:51:33AM +0800, Tiwei Bie wrote: > > > > On Tue, Apr 17, 2018 at 10:11:58AM +0800, Jason Wang wrote: > > > > > On

On Tue, Apr 17, 2018 at 05:04:59PM +0300, Michael S. Tsirkin wrote: > On Tue, Apr 17, 2018 at 08:47:16PM +0800, Tiwei Bie wrote: > > On Tue, Apr 17, 2018 at 03:17:41PM +0300, Michael S. Tsirkin wrote: > > > On Tue, Apr 17, 2018 at 10:51:33AM +0800, Tiwei Bie wrote: > > > > On Tue, Apr 17, 2018 at 10:11:58AM +0800, Jason Wang wrote: > > > > > On

...sole port and then plugging in a new one on the same number (re-using the vqs which were just 'disowned'). qemu reported 'Guest moved used index from 0 to 256' when any IO was attempted on the new port. CC: stable at kernel.org Reported-by: juzhang <juzhang at redhat.com> Signed-off-by: Amit Shah <amit.shah at redhat.com> Signed-off-by: Rusty Russell <rusty at rustcorp.com.au> The spec is quite explicit though: A driver MUST NOT decrement the available idx on a live virtqueue (ie. there is no way to ?unexpose? buf...

A crash was observed when a device gets removed while a port is in use. When the port gets removed, we tried to free vq buffers. The vq no longer exists at this stage, just ensure we don't access it. The second patch fixes a warning where the pci region is already freed. I'm not sure what or how the region gets freed, any clues there will be helpful. Thanks, Amit Amit Shah (2):

A crash was observed when a device gets removed while a port is in use. When the port gets removed, we tried to free vq buffers. The vq no longer exists at this stage, just ensure we don't access it. The second patch fixes a warning where the pci region is already freed. I'm not sure what or how the region gets freed, any clues there will be helpful. Thanks, Amit Amit Shah (2):