From 5be5f9be724d43fbec3d6f955a43bc64a62d55cc Mon Sep 17 00:00:00 2001 From: =?utf8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 27 Jul 2016 01:15:01 +0400 Subject: [PATCH] vhost: fix cleanup on not fully initialized device MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit If vhost_dev_init() failed, caller may still call vhost_dev_cleanup() later. However, vhost_dev_cleanup() tries to remove the device from the list even if it wasn't yet added, which may lead to crashes. Similarly for the memory listener. Signed-off-by: Marc-André Lureau Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/vhost.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 8a18f9b669..6b988e1478 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -1033,7 +1033,6 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque, r = -1; goto fail; } - QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); r = hdev->vhost_ops->vhost_set_owner(hdev); if (r < 0) { @@ -1103,6 +1102,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque, hdev->started = false; hdev->memory_changed = false; memory_listener_register(&hdev->memory_listener, &address_space_memory); + QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); return 0; fail_busyloop: while (--i >= 0) { @@ -1126,7 +1126,11 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) for (i = 0; i < hdev->nvqs; ++i) { vhost_virtqueue_cleanup(hdev->vqs + i); } - memory_listener_unregister(&hdev->memory_listener); + if (hdev->mem) { + /* those are only safe after successful init */ + memory_listener_unregister(&hdev->memory_listener); + QLIST_REMOVE(hdev, entry); + } if (hdev->migration_blocker) { migrate_del_blocker(hdev->migration_blocker); error_free(hdev->migration_blocker); @@ -1135,7 +1139,6 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) g_free(hdev->mem_sections); hdev->vhost_ops->vhost_backend_cleanup(hdev); assert(!hdev->log); - QLIST_REMOVE(hdev, entry); } /* Stop processing guest IO notifications in qemu. -- 2.11.4.GIT