uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

virtio-iommu: fix OOM due to unbounded call_rcu

Browse source 
Currently, within virtio-iommu, handle_command processes the command vq
without any limits on the number of entries processed.
This can easily and repeatedly enable/disable multiple memory regions.
Within the memory code, this causes an accumulation of an
unbounded number of RCU-deferred FlatViews - each of these
is supposed to be freed with call_rcu, but that never happens
because the main thread never returns to the main loop.

Given FlatView is big, it's easy to have this balloon out to multiple
Gigabytes of memory.

Limit the loop defer any remaining work to a timer.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3930
Cc: Eric Auger <eric.auger@redhat.com>
Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Jia Jia <physicalmtea@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <eb46ab360dbe28c29cfa78812a7440dcb7444d59.1784807826.git.mst@redhat.com>
This commit is contained in:
Michael S. Tsirkin 2026-07-23 07:58:43 -04:00
parent 733a98a552
commit 67550d65b4
2 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

29
hw/virtio/virtio-iommu.c
View file

@ -993,6 +993,18 @@ static int virtio_iommu_handle_probe(VirtIOIOMMU *s,
return ret ? ret : virtio_iommu_probe(s, &req, buf);
}
static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq);
static void virtio_iommu_handle_command_timer(void *opaque)
{
VirtIOIOMMU *s = opaque;
VirtIODevice *vdev = VIRTIO_DEVICE(s);
if (virtio_device_started(vdev, vdev->status) && !vdev->broken) {
virtio_iommu_handle_command(vdev, s->req_vq);
}
}
static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
{
VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);
@ -1003,10 +1015,17 @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
struct iovec *iov;
void *buf = NULL;
size_t sz;
unsigned int batch = 0;
for (;;) {
size_t output_size = sizeof(tail);
if (++batch > virtio_queue_get_num(vdev, virtio_get_queue_index(vq))) {
timer_mod(s->cmd_timer,
qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) + 1);
break;
}
elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
if (!elem) {
return;
@ -1416,6 +1435,8 @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)
s->req_vq = virtio_add_queue(vdev, VIOMMU_DEFAULT_QUEUE_SIZE,
virtio_iommu_handle_command);
s->event_vq = virtio_add_queue(vdev, VIOMMU_DEFAULT_QUEUE_SIZE, NULL);
s->cmd_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL_RT,
virtio_iommu_handle_command_timer, s);
/*
* config.bypass is needed to get initial address space early, such as
@ -1498,6 +1519,7 @@ static void virtio_iommu_device_unrealize(DeviceState *dev)
qemu_rec_mutex_destroy(&s->mutex);
timer_free(s->cmd_timer);
virtio_delete_queue(s->req_vq);
virtio_delete_queue(s->event_vq);
virtio_cleanup(vdev);
@ -1509,6 +1531,8 @@ static void virtio_iommu_device_reset_exit(Object *obj, ResetType type)
trace_virtio_iommu_device_reset_exit();
timer_del(s->cmd_timer);
if (s->domains) {
g_tree_destroy(s->domains);
}
@ -1628,6 +1652,11 @@ static int iommu_post_load(void *opaque, int version_id)
* still correct.
*/
virtio_iommu_switch_address_space_all(s);
if (virtio_device_started(VIRTIO_DEVICE(s), VIRTIO_DEVICE(s)->status)) {
timer_mod(s->cmd_timer,
qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) + 1);
}
return 0;
}

1
include/hw/virtio/virtio-iommu.h
View file

@ -65,6 +65,7 @@ struct VirtIOIOMMU {
GTree *domains;
QemuRecMutex mutex;
GTree *endpoints;
QEMUTimer *cmd_timer;
bool boot_bypass;
Notifier machine_done;
bool granule_frozen;