lkml.org 
[lkml]   [2016]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.6 078/203] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
    Date
    4.6-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Xiubo Li <lixiubo@cmss.chinamobile.com>

    commit caf1ff26e1aa178133df68ac3d40815fed2187d9 upstream.

    These days, we experienced one guest crash with 8 cores and 3 disks,
    with qemu error logs as bellow:

    qemu-system-x86_64: /build/qemu-2.0.0/kvm-all.c:984:
    kvm_irqchip_commit_routes: Assertion `ret == 0' failed.

    And then we found one patch(bdf026317d) in qemu tree, which said
    could fix this bug.

    Execute the following script will reproduce the BUG quickly:

    irq_affinity.sh
    ========================================================================

    vda_irq_num=25
    vdb_irq_num=27
    while [ 1 ]
    do
    for irq in {1,2,4,8,10,20,40,80}
    do
    echo $irq > /proc/irq/$vda_irq_num/smp_affinity
    echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
    dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
    dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
    done
    done
    ========================================================================

    The following qemu log is added in the qemu code and is displayed when
    this bug reproduced:

    kvm_irqchip_commit_routes: max gsi: 1008, nr_allocated_irq_routes: 1024,
    irq_routes->nr: 1024, gsi_count: 1024.

    That's to say when irq_routes->nr == 1024, there are 1024 routing entries,
    but in the kernel code when routes->nr >= 1024, will just return -EINVAL;

    The nr is the number of the routing entries which is in of
    [1 ~ KVM_MAX_IRQ_ROUTES], not the index in [0 ~ KVM_MAX_IRQ_ROUTES - 1].

    This patch fix the BUG above.

    Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
    Signed-off-by: Wei Tang <tangwei@cmss.chinamobile.com>
    Signed-off-by: Zhang Zhuoyu <zhangzhuoyu@cmss.chinamobile.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    virt/kvm/kvm_main.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/virt/kvm/kvm_main.c
    +++ b/virt/kvm/kvm_main.c
    @@ -2868,7 +2868,7 @@ static long kvm_vm_ioctl(struct file *fi
    if (copy_from_user(&routing, argp, sizeof(routing)))
    goto out;
    r = -EINVAL;
    - if (routing.nr >= KVM_MAX_IRQ_ROUTES)
    + if (routing.nr > KVM_MAX_IRQ_ROUTES)
    goto out;
    if (routing.flags)
    goto out;

    \
     
     \ /
      Last update: 2016-07-26 01:01    [W:2.443 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site