Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1466180

[PATCH 3.12 011/100] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES

Show all headers | View raw

From: Xiubo Li <lixiubo@cmss.chinamobile.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit caf1ff26e1aa178133df68ac3d40815fed2187d9 upstream.

These days, we experienced one guest crash with 8 cores and 3 disks,
with qemu error logs as bellow:

qemu-system-x86_64: /build/qemu-2.0.0/kvm-all.c:984:
kvm_irqchip_commit_routes: Assertion `ret == 0' failed.

And then we found one patch(bdf026317d) in qemu tree, which said
could fix this bug.

Execute the following script will reproduce the BUG quickly:

irq_affinity.sh
========================================================================

vda_irq_num=25
vdb_irq_num=27
while [ 1 ]
do
    for irq in {1,2,4,8,10,20,40,80}
        do
            echo $irq > /proc/irq/$vda_irq_num/smp_affinity
            echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
            dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
            dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
        done
done
========================================================================

The following qemu log is added in the qemu code and is displayed when
this bug reproduced:

kvm_irqchip_commit_routes: max gsi: 1008, nr_allocated_irq_routes: 1024,
irq_routes->nr: 1024, gsi_count: 1024.

That's to say when irq_routes->nr == 1024, there are 1024 routing entries,
but in the kernel code when routes->nr >= 1024, will just return -EINVAL;

The nr is the number of the routing entries which is in of
[1 ~ KVM_MAX_IRQ_ROUTES], not the index in [0 ~ KVM_MAX_IRQ_ROUTES - 1].

This patch fix the BUG above.

Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Wei Tang <tangwei@cmss.chinamobile.com>
Signed-off-by: Zhang Zhuoyu <zhangzhuoyu@cmss.chinamobile.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 virt/kvm/kvm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f8a3dd96a37a..3351605d2608 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2438,7 +2438,7 @@ static long kvm_vm_ioctl(struct file *filp,
 		if (copy_from_user(&routing, argp, sizeof(routing)))
 			goto out;
 		r = -EINVAL;
-		if (routing.nr >= KVM_MAX_IRQ_ROUTES)
+		if (routing.nr > KVM_MAX_IRQ_ROUTES)
 			goto out;
 		if (routing.flags)
 			goto out;
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 000/100] 3.12.63-stable review Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:20 +0200
  [PATCH 3.12 001/100] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 002/100] mm: migrate dirty page without clear_page_dirty_for_io etc Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 004/100] printk: do cond_resched() between lines while outputting to consoles Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/100] libceph: set 'exists' flag for newly up osd Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 024/100] ALSA: ctl: Stop notification after disconnection Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 021/100] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 015/100] iio: Fix error handling in iio_trigger_attach_poll_func Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 020/100] iio:ad7266: Fix probe deferral for vref Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 011/100] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 025/100] scsi: fix race between simultaneous decrements of ->host_failed Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 022/100] ALSA: dummy: Fix a use-after-free at closing Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 023/100] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 016/100] staging: iio: accel: fix error check Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 026/100] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/101] netfilter: x_tables: speed up jump target validation Jiri Slaby <jslaby@suse.cz> - 2016-08-19 10:00 +0200
  Re: [PATCH 3.12 000/100] 3.12.63-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-19 21:10 +0200

csiph-web