[Qemu-commits] [qemu/qemu] 4e494d: Qemu/Xen: Fix early freeing MSIX MMIO memory regio...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 4e494de66800747446e73b5ec0189ad7f4690908
      
https://github.com/qemu/qemu/commit/4e494de66800747446e73b5ec0189ad7f4690908
  Author: Lan Tianyu <address@hidden>
  Date:   2015-10-26 (Mon, 26 Oct 2015)

  Changed paths:
    M hw/xen/xen_pt.c
    M hw/xen/xen_pt.h
    M hw/xen/xen_pt_config_init.c
    M hw/xen/xen_pt_msi.c

  Log Message:
  -----------
  Qemu/Xen: Fix early freeing MSIX MMIO memory region

msix->mmio is added to XenPCIPassthroughState's object as property.
object_finalize_child_property is called for XenPCIPassthroughState's
object, which calls object_property_del_all, which is going to try to
delete msix->mmio. object_finalize_child_property() will access
msix->mmio's obj. But the whole msix struct has already been freed
by xen_pt_msix_delete. This will cause segment fault when msix->mmio
has been overwritten.

This patch is to fix the issue.

Signed-off-by: Lan Tianyu <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>


  Commit: 4098d49db549e20a2d87ca3cced28ace6e5864bf
      
https://github.com/qemu/qemu/commit/4098d49db549e20a2d87ca3cced28ace6e5864bf
  Author: Stefano Stabellini <address@hidden>
  Date:   2015-10-26 (Mon, 26 Oct 2015)

  Changed paths:
    M hw/i386/xen/xen_platform.c

  Log Message:
  -----------
  xen_platform: switch to realize

Use realize to initialize the xen_platform device

Signed-off-by: Stefano Stabellini <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: b1ecd51bdbb0fc0a7026662b03e7e7df9d129ca0
      
https://github.com/qemu/qemu/commit/b1ecd51bdbb0fc0a7026662b03e7e7df9d129ca0
  Author: Eduardo Habkost <address@hidden>
  Date:   2015-10-26 (Mon, 26 Oct 2015)

  Changed paths:
    M hw/i386/xen/xen_platform.c

  Log Message:
  -----------
  xen-platform: Replace assert() with appropriate error reporting

Commit dbb7405d8caad0814ceddd568cb49f163a847561 made it possible to
trigger an assert using "-device xen-platform". Replace it with
appropriate error reporting.

Before:

  $ qemu-system-x86_64 -device xen-platform
  qemu-system-x86_64: hw/i386/xen/xen_platform.c:391: xen_platform_initfn: 
Assertion `xen_enabled()' failed.
  Aborted (core dumped)
  $

After:

  $ qemu-system-x86_64 -device xen-platform
  qemu-system-x86_64: -device xen-platform: xen-platform device requires the 
Xen accelerator
  $

Signed-off-by: Eduardo Habkost <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>


  Commit: 9666248a85fd889bfb6118f769e9c73039b998ed
      
https://github.com/qemu/qemu/commit/9666248a85fd889bfb6118f769e9c73039b998ed
  Author: Peter Maydell <address@hidden>
  Date:   2015-10-26 (Mon, 26 Oct 2015)

  Changed paths:
    M hw/i386/xen/xen_platform.c
    M hw/xen/xen_pt.c
    M hw/xen/xen_pt.h
    M hw/xen/xen_pt_config_init.c
    M hw/xen/xen_pt_msi.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/sstabellini/tags/xen-2015-10-26' into 
staging

Xen 2015-10-26

# gpg: Signature made Mon 26 Oct 2015 11:32:50 GMT using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <address@hidden>"

* remotes/sstabellini/tags/xen-2015-10-26:
  xen-platform: Replace assert() with appropriate error reporting
  xen_platform: switch to realize
  Qemu/Xen: Fix early freeing MSIX MMIO memory region

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/251d7e601485...9666248a85fd