[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 1/1] accel/kvm/kvm-all: fix vm crash when set dirty ring and memo
From: |
Jiajing Zhou |
Subject: |
[PATCH 1/1] accel/kvm/kvm-all: fix vm crash when set dirty ring and memorybacking |
Date: |
Thu, 23 Mar 2023 21:19:15 +0800 |
From: "zhoujiajing.vergil" <zhoujiajing.vergil@bytedance.com>
It is possible enter this function when the cpu not finished creating but
is already in the cpu list. The value of dirty_gfns is null, causing vm
crash here.
When both dirty-ring and memorybacking are set, creating a vm will assert
on kvm_dirty_ring_reap_one. Part of the xml as follows:
<domain type='kvm' id='9'>
...
<memoryBacking>
<hugepages>
<page size='2048' unit='KiB' memAccess='shared'/>
</hugepages>
</memoryBacking>
...
<features>
<acpi/>
<kvm>
<dirty-ring state='on' size='4096'/>
</kvm>
</features>
...
<domain/>
The kvm-reaper thread was created before vcpu thread, and the value of
cpu->kvm_dirty_gfns is assigned at cpu thread. In the x86_cpu_realizefn
function, the cpu is inserted into the cpu list first, and then the cpu
thread is created for initialization. The entry functions are
cpu_exec_realizefn and qemu_init_vcpu. In the existing logic, the
kvm-reaper thread traverses the cpu list every second and finally call
kvm_dirty_ring_reap_one for each cpu in the list. If cpu has been inserted
into cpu list but has not been initialized so that the value of dirty_gfns
is null, kvm-reaper thread call kvm_dirty_ring_reap_one will cause vm crash.
The call stack is as follows:
kvm_dirty_ring_reaper_thread
-> kvm_dirty_ring_reap
->kvm_dirty_ring_reap_locked
->kvm_dirty_ring_reap_one
Signed-off-by: zhoujiajing.vergil <zhoujiajing.vergil@bytedance.com>
---
accel/kvm/kvm-all.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f2a6ea6a68..698a59162a 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -685,6 +685,11 @@ static uint32_t kvm_dirty_ring_reap_one(KVMState *s,
CPUState *cpu)
uint32_t ring_size = s->kvm_dirty_ring_size;
uint32_t count = 0, fetch = cpu->kvm_fetch_index;
+ /* return 0 when cpu not finished creating */
+ if (!cpu->created) {
+ return 0;
+ }
+
assert(dirty_gfns && ring_size);
trace_kvm_dirty_ring_reap_vcpu(cpu->cpu_index);
--
2.40.0
- [PATCH 1/1] accel/kvm/kvm-all: fix vm crash when set dirty ring and memorybacking,
Jiajing Zhou <=