Commit the memory region transaction before sending the SHMEM_MAP reply so the KVM memory slot exists before the guest can access the mapped region.
This moves the commit to while the backend is still blocked waiting for the reply, which can trigger ADD_MEM_REG back to the backend and deadlock. Filter shmem mapping regions out of vhost_section() by checking the MR owner type to prevent this. Signed-off-by: Dorinda Bassey <[email protected]> --- hw/virtio/vhost-user.c | 6 +++--- hw/virtio/vhost.c | 10 ++++++++++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 517cc4ca716..8d0f463aab8 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1998,17 +1998,17 @@ vhost_user_backend_handle_shmem_map(struct vhost_dev *dev, } send_reply_commit: - /* Send reply and commit after transaction started */ + /* Commit before reply so the KVM memory slot exists before guest access */ + memory_region_transaction_commit(); + if (hdr->flags & VHOST_USER_NEED_REPLY_MASK) { payload->u64 = !!ret; hdr->size = sizeof(payload->u64); if (!vhost_user_send_resp(ioc, hdr, payload, &local_err)) { error_report_err(local_err); - memory_region_transaction_commit(); return -EFAULT; } } - memory_region_transaction_commit(); return 0; send_reply: diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index af41841b529..e5c219be095 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -636,6 +636,16 @@ static bool vhost_section(struct vhost_dev *dev, MemoryRegionSection *section) { MemoryRegion *mr = section->mr; + /* + * Skip shmem mapping regions, they are managed via SHMEM_MAP/UNMAP. + * Including them triggers ADD_MEM_REG during the SHMEM_MAP transaction + * commit, deadlocking the backend. + */ + if (object_dynamic_cast(memory_region_owner(mr), + TYPE_VIRTIO_SHARED_MEMORY_MAPPING)) { + return false; + } + if (memory_region_is_ram(mr) && !memory_region_is_rom(mr)) { uint8_t dirty_mask = memory_region_get_dirty_log_mask(mr); uint8_t handled_dirty; -- 2.52.0
