mirror of
https://github.com/qemu/qemu.git
synced 2025-08-03 06:33:33 +00:00
2865bf1c57
A use-after-free bug was reported when booting a Linux kernel during the pci setup phase. It's quite hard to reproduce (needs smp, and favored by having several pci devices with BAR and specific Linux config, which is Debian default one in this case). After investigation (see the associated bug ticket), it appears that, under specific conditions, we might access a cached AddressSpaceDispatch that was reclaimed by RCU thread meanwhile. In the Linux boot scenario, during the pci phase, memory region are destroyed/recreated, resulting in exposition of the bug. The core of the issue is that we cache the dispatch associated to current cpu in cpu->cpu_ases[asidx].memory_dispatch. It is updated with tcg_commit, which runs asynchronously on a given cpu. At some point, we leave the rcu critial section, and the RCU thread starts reclaiming it, but tcg_commit is not yet invoked, resulting in the use-after-free. It's not the first problem around this area, and commit |
||
|---|---|---|
| .. | ||
| arch_init.c | ||
| async-teardown.c | ||
| balloon.c | ||
| bootdevice.c | ||
| cpu-timers.c | ||
| cpus.c | ||
| datadir.c | ||
| device_tree-stub.c | ||
| device_tree.c | ||
| dirtylimit.c | ||
| dma-helpers.c | ||
| globals-target.c | ||
| globals.c | ||
| ioport.c | ||
| main.c | ||
| memory_ldst.c.inc | ||
| memory_mapping.c | ||
| memory-internal.h | ||
| memory.c | ||
| meson.build | ||
| physmem.c | ||
| qdev-monitor.c | ||
| qemu-seccomp.c | ||
| qtest.c | ||
| ram-block-attributes.c | ||
| rtc.c | ||
| runstate-action.c | ||
| runstate-hmp-cmds.c | ||
| runstate.c | ||
| tpm-hmp-cmds.c | ||
| tpm.c | ||
| trace-events | ||
| trace.h | ||
| vl.c | ||
| watchpoint.c | ||