From patchwork Fri Feb 1 16:06:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 157285 Delivered-To: patch@linaro.org Received: by 2002:a02:48:0:0:0:0:0 with SMTP id 69csp649683jaa; Fri, 1 Feb 2019 08:33:54 -0800 (PST) X-Google-Smtp-Source: ALg8bN5qPla4i1XePvTuyh295ilpUqtngOcxkiY85I3A9HVxToz+WVpwKf7rwo52Yc79p34r4toL X-Received: by 2002:a25:9348:: with SMTP id g8mr40088344ybo.394.1549038834837; Fri, 01 Feb 2019 08:33:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549038834; cv=none; d=google.com; s=arc-20160816; b=ogAxJPghI47KW4lMvkfsoduzHgNtBU2W35MatuPtwn6vAn/zxuz5AfidEoeLd6Bh0W NDNJBsoOBI16NkI+rCuCllbClw+thxwbjdqN+gt83Fsz0mJzwW9c+tcD6Lk7Og/pp3T1 lSBgc+hlrY7o4FygKZEDFsTEOGHiKUaAiGeEHDt+qBU9mZjjyE5H/agubHrBZpa8xI4X 6oTZxz9EuOyxZnCNbpTXc0zenNU7LMnPsmwnUnUd9EZ1OuCT3RrLgpgi56QrbX9/t63l rPEzu6SR9J6w7hNQSZN9ZMXjqIXJRPOjT5VrEb5Bn9QMGpk3X4Go8TGftSdQ9jMficCp EsMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:to:from:dkim-signature; bh=b9P1Xt5I5OJh/t+zJxdp8JNteub9Ra3hvV+vGC72MxQ=; b=cS3OGDw1ry1EN8+gV3L2J4MMOfPj6TGF2qBFIS6/bVI/ybeZN7Q8pP3aGMSmnMeuzq JLyGLoWIx3GdDOoO9Zb60lc3NNoca4Sa8VvZhylJlrIBaGtfEfsxnMxk9mz4kBwzFUim 8ewY+XxVgsAziE4hM/qkQUSPdpnlmwqm7t8Lxhv7cDuvEyg+YKP0izgLuowEQP6gZbG5 86nzsCEbIBi/ARAY0LyK90n1xqBkEselsIHjW1YpAefeRxOi9xWb+hoit2m/xJFcgpvD +K5Jh1oEBCUwoFoQpFESnr8iA9vJ/Dn9IsiHUFJ/oK6Ygb8aHPRr8Bm0tNGierQ7+Mxz FQbQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=BbFTG+mX; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id i184si4765810ybi.202.2019.02.01.08.33.54 for (version=TLS1 cipher=AES128-SHA bits=128/128); Fri, 01 Feb 2019 08:33:54 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=BbFTG+mX; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([127.0.0.1]:57601 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gpblK-0003ya-8L for patch@linaro.org; Fri, 01 Feb 2019 11:33:54 -0500 Received: from eggs.gnu.org ([209.51.188.92]:59012) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gpbMD-0008Gg-OF for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:08:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gpbMA-0003j6-PN for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:07:57 -0500 Received: from mail-wr1-x42d.google.com ([2a00:1450:4864:20::42d]:44169) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gpbMA-0003a4-CL for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:07:54 -0500 Received: by mail-wr1-x42d.google.com with SMTP id z5so7630465wrt.11 for ; Fri, 01 Feb 2019 08:07:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=b9P1Xt5I5OJh/t+zJxdp8JNteub9Ra3hvV+vGC72MxQ=; b=BbFTG+mXk1/vAMtJtfm5hJDdE+ygBeAc9VxZy1uRvrDPAFRjn+/ew1cOyutRuxev2c zSeQ/q9cwNp7b27YH0bzboVeqwdMUtkOHn7VKaLZ6BgjqGBJzmsYIQzZ5+PQM4t3bq2e VLE60am8Oiv5amN17irwK3JIVOHQEqm1Pd2Zs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=b9P1Xt5I5OJh/t+zJxdp8JNteub9Ra3hvV+vGC72MxQ=; b=TVoEyA09D2Dm1Q8RtMe9PEQAJBD2QpB96/DHMx5b0486Y4UeC5Utioi5VMnpHLyaJQ aUI2C+/zGsM0uVcqy9gaT9F550SD2v8easN+4g96gxSRej6JbbztSfvx8UjF+uMjNrRJ 0ER1rP+ZTLQoT82rQhelMg+IBBSIHisoRbUUf/fd/fj1bQuoRAXyO9MtLv9G/74g+dzG hEWDXLVxUxKR3nJaYCyVBDGq75ZIraFLZMe7TcHWTR+G2CN2dpssnZfwJ2/BovKBinEt Kt9SLFxbJxU0uYBqvVSDOLnx5M1oc7trkjHJ4RejfMmXLAInnOXkKZ9BRr+zp9xJq1Yb 7S8A== X-Gm-Message-State: AJcUukduP82bc9vobrYZuGdQlSreFFqMHVqGpjrj2gW8jnnhPWscim4b uGZMpjgrvIdSfpZqxXXkBcKZ0dWtiCH2Zw== X-Received: by 2002:a5d:6549:: with SMTP id z9mr38153439wrv.116.1549037256666; Fri, 01 Feb 2019 08:07:36 -0800 (PST) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [81.2.115.148]) by smtp.gmail.com with ESMTPSA id n6sm2847250wmk.9.2019.02.01.08.07.35 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 01 Feb 2019 08:07:35 -0800 (PST) From: Peter Maydell To: qemu-devel@nongnu.org Date: Fri, 1 Feb 2019 16:06:38 +0000 Message-Id: <20190201160653.13829-33-peter.maydell@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190201160653.13829-1-peter.maydell@linaro.org> References: <20190201160653.13829-1-peter.maydell@linaro.org> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::42d Subject: [Qemu-devel] [PULL 32/47] exec.c: Don't reallocate IOMMUNotifiers that are in use X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" The tcg_register_iommu_notifier() code has a GArray of TCGIOMMUNotifier structs which it has registered by passing memory_region_register_iommu_notifier() a pointer to the embedded IOMMUNotifier field. Unfortunately, if we need to enlarge the array via g_array_set_size() this can cause a realloc(), which invalidates the pointer that memory_region_register_iommu_notifier() put into the MemoryRegion's iommu_notify list. This can result in segfaults. Switch the GArray to holding pointers to the TCGIOMMUNotifier structs, so that we can individually allocate and free them. Cc: qemu-stable@nongnu.org Fixes: 1f871c5e6b0f30644a60a ("exec.c: Handle IOMMUs in address_space_translate_for_iotlb()") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20190128174241.5860-1-peter.maydell@linaro.org --- exec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.20.1 diff --git a/exec.c b/exec.c index da3e635f91b..25f3938a271 100644 --- a/exec.c +++ b/exec.c @@ -665,7 +665,7 @@ static void tcg_register_iommu_notifier(CPUState *cpu, int i; for (i = 0; i < cpu->iommu_notifiers->len; i++) { - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i); if (notifier->mr == mr && notifier->iommu_idx == iommu_idx) { break; } @@ -673,7 +673,8 @@ static void tcg_register_iommu_notifier(CPUState *cpu, if (i == cpu->iommu_notifiers->len) { /* Not found, add a new entry at the end of the array */ cpu->iommu_notifiers = g_array_set_size(cpu->iommu_notifiers, i + 1); - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_new0(TCGIOMMUNotifier, 1); + g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i) = notifier; notifier->mr = mr; notifier->iommu_idx = iommu_idx; @@ -705,8 +706,9 @@ static void tcg_iommu_free_notifier_list(CPUState *cpu) TCGIOMMUNotifier *notifier; for (i = 0; i < cpu->iommu_notifiers->len; i++) { - notifier = &g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier, i); + notifier = g_array_index(cpu->iommu_notifiers, TCGIOMMUNotifier *, i); memory_region_unregister_iommu_notifier(notifier->mr, ¬ifier->n); + g_free(notifier); } g_array_free(cpu->iommu_notifiers, true); } @@ -976,7 +978,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp) vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu); } - cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier)); + cpu->iommu_notifiers = g_array_new(false, true, sizeof(TCGIOMMUNotifier *)); #endif }