yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
958e1b
From e346f15b5c72e3cf58fbf1af4a89c929dea783ad Mon Sep 17 00:00:00 2001
958e1b
From: Marcel Apfelbaum <marcel.a@redhat.com>
958e1b
Date: Tue, 28 Oct 2014 14:13:15 +0100
958e1b
Subject: [PATCH 2/9] hw/pci: fix error flow in pci multifunction init
958e1b
958e1b
Message-id: <1414505595-17009-1-git-send-email-marcel.a@redhat.com>
958e1b
Patchwork-id: 61953
958e1b
O-Subject: [RHEL-7.1 qemu-kvm PATCH] hw/pci: fix error flow in pci multifunction init
958e1b
Bugzilla: 1049734
958e1b
RH-Acked-by: Amos Kong <akong@redhat.com>
958e1b
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
958e1b
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
958e1b
958e1b
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1049734
958e1b
Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=8164686
958e1b
Upstream-status: 306077640a652e090779498aadbeb0c605feaacd
958e1b
958e1b
Scenario:
958e1b
  - There is a non multifunction pci device A on 00:0X.0.
958e1b
  - Hot-plug another multifunction pci device B at 00:0X.1.
958e1b
  - The operation will fail of course.
958e1b
  - Try to hot-plug the B device 2-3 more times, qemu will crash.
958e1b
958e1b
Reason: The error flow leaves the B's address space into global address spaces
958e1b
list, but the device object is freed. Fixed that.
958e1b
958e1b
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
958e1b
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
958e1b
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
958e1b
(cherry picked from commit 306077640a652e090779498aadbeb0c605feaacd)
958e1b
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
958e1b
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
958e1b
958e1b
Conflicts:
958e1b
	hw/pci/pci.c
958e1b
        - The patch moves a function within a file and the function's
958e1b
          content is different from upstream.
958e1b
        - The upstream does not call anymore to qemu_free_irqs, but
958e1b
          the downstream version still does. We need to check that
958e1b
          the irq is allocated before calling it.
958e1b
958e1b
scripts/git-backport-diff:
958e1b
        001/1:[0021] [FC] 'hw/pci: fix error flow in pci multifunction init'
958e1b
958e1b
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
958e1b
---
958e1b
 hw/pci/pci.c | 33 ++++++++++++++++++---------------
958e1b
 1 file changed, 18 insertions(+), 15 deletions(-)
958e1b
---
958e1b
 hw/pci/pci.c | 33 ++++++++++++++++++---------------
958e1b
 1 file changed, 18 insertions(+), 15 deletions(-)
958e1b
958e1b
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
958e1b
index d166ab0..703b111 100644
958e1b
--- a/hw/pci/pci.c
958e1b
+++ b/hw/pci/pci.c
958e1b
@@ -784,6 +784,23 @@ static void pci_config_free(PCIDevice *pci_dev)
958e1b
     g_free(pci_dev->used);
958e1b
 }
958e1b
 
958e1b
+static void do_pci_unregister_device(PCIDevice *pci_dev)
958e1b
+{
958e1b
+    if (pci_dev->irq) {
958e1b
+        qemu_free_irqs(pci_dev->irq);
958e1b
+    }
958e1b
+
958e1b
+    pci_dev->bus->devices[pci_dev->devfn] = NULL;
958e1b
+    pci_config_free(pci_dev);
958e1b
+
958e1b
+    if (!pci_dev->bus->dma_context_fn) {
958e1b
+        address_space_destroy(&pci_dev->bus_master_as);
958e1b
+        memory_region_destroy(&pci_dev->bus_master_enable_region);
958e1b
+        g_free(pci_dev->dma);
958e1b
+        pci_dev->dma = NULL;
958e1b
+    }
958e1b
+}
958e1b
+
958e1b
 /* -1 for devfn means auto assign */
958e1b
 static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
958e1b
                                          const char *name, int devfn)
958e1b
@@ -852,7 +869,7 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
958e1b
         pci_init_mask_bridge(pci_dev);
958e1b
     }
958e1b
     if (pci_init_multifunction(bus, pci_dev)) {
958e1b
-        pci_config_free(pci_dev);
958e1b
+        do_pci_unregister_device(pci_dev);
958e1b
         return NULL;
958e1b
     }
958e1b
 
958e1b
@@ -868,20 +885,6 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
958e1b
     return pci_dev;
958e1b
 }
958e1b
 
958e1b
-static void do_pci_unregister_device(PCIDevice *pci_dev)
958e1b
-{
958e1b
-    qemu_free_irqs(pci_dev->irq);
958e1b
-    pci_dev->bus->devices[pci_dev->devfn] = NULL;
958e1b
-    pci_config_free(pci_dev);
958e1b
-
958e1b
-    if (!pci_dev->bus->dma_context_fn) {
958e1b
-        address_space_destroy(&pci_dev->bus_master_as);
958e1b
-        memory_region_destroy(&pci_dev->bus_master_enable_region);
958e1b
-        g_free(pci_dev->dma);
958e1b
-        pci_dev->dma = NULL;
958e1b
-    }
958e1b
-}
958e1b
-
958e1b
 static void pci_unregister_io_regions(PCIDevice *pci_dev)
958e1b
 {
958e1b
     PCIIORegion *r;
958e1b
-- 
958e1b
1.8.3.1
958e1b