diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2020-11-02 16:57:09 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2020-11-03 16:39:05 -0500 |
| commit | b7c1bd9d78480481455678602c9a8505cc8adadd (patch) | |
| tree | 99d11975694d364d0e2fef692ec0b1a614ae0bfa /hw/block | |
| parent | 1bc211a166be2c98f98852124b6fdb61e0b0be32 (diff) | |
Revert "vhost-blk: set features before setting inflight feature"
This reverts commit adb29c027341ba095a3ef4beef6aaef86d3a520e.
The commit broke -device vhost-user-blk-pci because the
vhost_dev_prepare_inflight() function it introduced segfaults in
vhost_dev_set_features() when attempting to access struct vhost_dev's
vdev pointer before it has been assigned.
To reproduce the segfault simply launch a vhost-user-blk device with the
contrib vhost-user-blk device backend:
$ build/contrib/vhost-user-blk/vhost-user-blk -s /tmp/vhost-user-blk.sock -r -b /var/tmp/foo.img
$ build/qemu-system-x86_64 \
-device vhost-user-blk-pci,id=drv0,chardev=char1,addr=4.0 \
-object memory-backend-memfd,id=mem,size=1G,share=on \
-M memory-backend=mem,accel=kvm \
-chardev socket,id=char1,path=/tmp/vhost-user-blk.sock
Segmentation fault (core dumped)
Cc: Jin Yu <jin.yu@intel.com>
Cc: Raphael Norwitz <raphael.norwitz@nutanix.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201102165709.232180-1-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/block')
| -rw-r--r-- | hw/block/vhost-user-blk.c | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index f67b29bbf3..a076b1e54d 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -131,12 +131,6 @@ static int vhost_user_blk_start(VirtIODevice *vdev) s->dev.acked_features = vdev->guest_features; - ret = vhost_dev_prepare_inflight(&s->dev); - if (ret < 0) { - error_report("Error set inflight format: %d", -ret); - goto err_guest_notifiers; - } - if (!s->inflight->addr) { ret = vhost_dev_get_inflight(&s->dev, s->queue_size, s->inflight); if (ret < 0) { |