From patchwork Fri Jul 8 13:12:07 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kurz X-Patchwork-Id: 9220935 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 988EF60467 for ; Fri, 8 Jul 2016 13:12:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 87EFE287A2 for ; Fri, 8 Jul 2016 13:12:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7AA7C287A4; Fri, 8 Jul 2016 13:12:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E1E7E287A2 for ; Fri, 8 Jul 2016 13:12:43 +0000 (UTC) Received: from localhost ([::1]:45580 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bLVaE-0006xh-Eg for patchwork-qemu-devel@patchwork.kernel.org; Fri, 08 Jul 2016 09:12:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60372) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bLVZs-0006vF-KR for qemu-devel@nongnu.org; Fri, 08 Jul 2016 09:12:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bLVZo-0002SQ-CL for qemu-devel@nongnu.org; Fri, 08 Jul 2016 09:12:19 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:47509 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bLVZo-0002Rp-7N for qemu-devel@nongnu.org; Fri, 08 Jul 2016 09:12:16 -0400 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id u68D8Qm7024099 for ; Fri, 8 Jul 2016 09:12:13 -0400 Received: from e17.ny.us.ibm.com (e17.ny.us.ibm.com [129.33.205.207]) by mx0a-001b2d01.pphosted.com with ESMTP id 2415xnv13d-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Fri, 08 Jul 2016 09:12:13 -0400 Received: from localhost by e17.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 8 Jul 2016 09:12:13 -0400 Received: from d01dlp02.pok.ibm.com (9.56.250.167) by e17.ny.us.ibm.com (146.89.104.204) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 8 Jul 2016 09:12:10 -0400 X-IBM-Helo: d01dlp02.pok.ibm.com X-IBM-MailFrom: groug@kaod.org Received: from b01cxnp22034.gho.pok.ibm.com (b01cxnp22034.gho.pok.ibm.com [9.57.198.24]) by d01dlp02.pok.ibm.com (Postfix) with ESMTP id D3B556E803F; Fri, 8 Jul 2016 09:11:50 -0400 (EDT) Received: from b01ledav03.gho.pok.ibm.com (b01ledav003.gho.pok.ibm.com [9.57.199.108]) by b01cxnp22034.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u68DC9VX63504580; Fri, 8 Jul 2016 13:12:09 GMT Received: from b01ledav03.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7BD16B2050; Fri, 8 Jul 2016 09:12:09 -0400 (EDT) Received: from bahia.lan (unknown [9.164.146.113]) by b01ledav03.gho.pok.ibm.com (Postfix) with ESMTP id A98B3B2046; Fri, 8 Jul 2016 09:12:08 -0400 (EDT) From: Greg Kurz To: David Gibson Date: Fri, 08 Jul 2016 15:12:07 +0200 User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16070813-0040-0000-0000-000000C28114 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16070813-0041-0000-0000-0000049CA7B9 Message-Id: <146798352770.17402.11063109294574588761.stgit@bahia.lan> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-08_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607080125 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PATCH] spapr: fix core unplug crash X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-ppc@nongnu.org, qemu-devel@nongnu.org, Bharata B Rao Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP If the host has 8 threads/core and the guest is started with: -smp cores=1,threads=4,maxcpus=12 It is possible to crash QEMU by doing: (qemu) device_add host-spapr-cpu-core,core-id=16,id=foo (qemu) device_del foo Segmentation fault This is caused because spapr_core_unplug() assumes cpu_dt_id == core_id. Even if it happens to be the case when the host and guest have the same number of threads per core, it is conceptually wrong and we may pass a bogus id to spapr_dr_connector_by_id() and spapr_core_release() crashes. Let's use cc->core_id, which is the id that was used to create th DR connector. Signed-off-by: Greg Kurz Reviewed-by: Bharata B Rao --- hw/ppc/spapr_cpu_core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c index 70b6b0b5ee17..106eaf45b399 100644 --- a/hw/ppc/spapr_cpu_core.c +++ b/hw/ppc/spapr_cpu_core.c @@ -126,11 +126,9 @@ static void spapr_core_release(DeviceState *dev, void *opaque) void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp) { - sPAPRCPUCore *core = SPAPR_CPU_CORE(OBJECT(dev)); - PowerPCCPU *cpu = POWERPC_CPU(core->threads); - int id = ppc_get_vcpu_dt_id(cpu); + CPUCore *cc = CPU_CORE(dev); sPAPRDRConnector *drc = - spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_CPU, id); + spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_CPU, cc->core_id); sPAPRDRConnectorClass *drck; Error *local_err = NULL;