Re: Strange qemu6 regression cauing disabled usb controller.

2021-10-05 Thread Remy Noel
On Thu, Sep 30, 2021 at 04:05:52PM +0100, Daniel P. Berrangé wrote: Co-incidentally we've just had another bug report filed today that suggests 7bed89958bfbf40df9ca681cefbdca63abdde39d as a buggy commit causing deadlock in QEMU https://gitlab.com/qemu-project/qemu/-/issues/650 Is opening a gi

Re: Strange qemu6 regression cauing disabled usb controller.

2021-09-30 Thread Remy Noel
On Thu, Sep 30, 2021 at 04:05:52PM +0100, Daniel P. Berrangé wrote: On Thu, Sep 30, 2021 at 03:48:44PM +0200, Remy Noel wrote: Co-incidentally we've just had another bug report filed today that suggests 7bed89958bfbf40df9ca681cefbdca63abdde39d as a buggy commit causing deadlock in QEMU

Strange qemu6 regression cauing disabled usb controller.

2021-09-30 Thread Remy Noel
Hello, I'm encountering a nagging issue with usbredir and a windows guest, but although I did pinpoint the commit that caused the issue, I have a hard time understanding it. The issue occurs when a two usbredir devices are added to a guest windows vm. When the second device is added, the UHCI

Re: [PULL 4/6] usb/redir: avoid dynamic stack allocation (CVE-2021-3527)

2021-05-05 Thread Remy Noel
On Wed, May 05, 2021 at 03:07:14PM +0200, Gerd Hoffmann wrote: [...] diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c index 17f06f34179a..6a75b0dc4ab2 100644 --- a/hw/usb/redirect.c +++ b/hw/usb/redirect.c @@ -620,7 +620,7 @@ static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket

Re: [PULL 6/7] usb/xhci: sanity check packet size (CVE-2021-3527)

2021-05-04 Thread Remy Noel
Hello On Tue, May 04, 2021 at 10:53:16AM +0200, Gerd Hoffmann wrote: Make sure the usb packet size is within the bounds of the endpoint configuration. Signed-off-by: Gerd Hoffmann Message-Id: <20210503132915.2335822-5-kra...@redhat.com> --- hw/usb/hcd-xhci.c | 5 + 1 file changed, 5 inserti

Re: [Qemu-devel] [QEMU-devel][PATCH v4 0/2] Fix concurrent aio_poll/set_fd_handler.

2019-01-14 Thread remy . noel
On Sat, Jan 12, 2019 at 08:30:08AM +, Stefan Hajnoczi wrote: Thanks, applied to my block tree: https://github.com/stefanha/qemu/commits/block Thanks ! Remy

Re: [Qemu-devel] [QEMU-devel][PATCH v4 0/2] Fix concurrent aio_poll/set_fd_handler.

2019-01-07 Thread remy . noel
On Thu, Dec 20, 2018 at 04:20:28PM +0100, Remy Noel wrote: From: Remy Noel It is possible for an io_poll/read/write callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. V2: * Do not use

Re: [Qemu-devel] [QEMU-devel][PATCH v4 0/2] Fix concurrent aio_poll/set_fd_handler.

2018-12-24 Thread Remy NOEL
On 12/21/18 12:34 PM, Paolo Bonzini wrote: FWIW, I had missed the early version that used RCU, but lockcnt is already very RCU-like, so not using RCU is the right thing to do. The difference between lockcnt and RCU is that cleanup is done by the reader instead of a separate thread. Because we

[Qemu-devel] [QEMU-devel][PATCH v4 2/2] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-20 Thread remy . noel
From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. This changes set_fd_handlers so that it no longer modify existing handlers entries and

[Qemu-devel] [QEMU-devel][PATCH v4 0/2] Fix concurrent aio_poll/set_fd_handler.

2018-12-20 Thread remy . noel
From: Remy Noel It is possible for an io_poll/read/write callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. V2: * Do not use RCU anymore as it inccurs a performance loss V3: * Don&#

[Qemu-devel] [QEMU-devel][PATCH v4 1/2] aio-posix: Unregister fd from ctx epoll when removing fd_handler.

2018-12-20 Thread remy . noel
From: Remy Noel Cleaning the events will cause aio_epoll_update to unregister the fd. Otherwise, the fd is kept registered until it is destroyed. Signed-off-by: Remy Noel --- util/aio-posix.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/util/aio-posix.c b/util/aio-posix.c index

Re: [Qemu-devel] [QEMU-devel][PATCH v3] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-20 Thread Remy NOEL
On 12/19/18 8:32 PM, Paolo Bonzini wrote: You found another bug then. :) K. Will fix.

Re: [Qemu-devel] [QEMU-devel][PATCH v3] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-19 Thread Remy NOEL
On 12/18/18 3:14 PM, Stefan Hajnoczi wrote: Please include a changelog in future patches. For example: v3: * Don't drop revents when a handler is modified [Stefan] That way reviewers know what to look for and which issues you have addressed. Sorry, wasn't sure i had to do this in single com

Re: [Qemu-devel] [QEMU-devel][PATCH v3] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-19 Thread Remy NOEL
On 12/18/18 6:39 PM, Paolo Bonzini wrote: On 17/12/18 17:48, remy.n...@blade-group.com wrote: Also, we do not call aio_epoll_update for deleted handlers as this has no impact whatsoever. Why? epoll is used in level-triggered mode, so you do have to remove the file descriptor...

[Qemu-devel] [QEMU-devel][PATCH v3] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-17 Thread remy . noel
From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. This changes set_fd_handlers so that it no longer modify existing handlers entries and

Re: [Qemu-devel] [QEMU-devel][PATCH v2] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-11 Thread Remy NOEL
On 12/10/18 8:05 PM, Stefan Hajnoczi wrote: On Thu, Dec 06, 2018 at 11:14:23AM +0100, remy.n...@blade-group.com wrote: +if (is_new) { +new_node->pfd.fd = fd; +} else { +deleted = aio_remove_fd_handler(ctx, node); +new_node->pfd = node->pfd; D

Re: [Qemu-devel] [PATCH] aio_poll race condition.

2018-12-07 Thread Remy NOEL
rds. Remy On 12/7/18 11:09 AM, Philippe Mathieu-Daudé wrote: Hi Remy, On 11/16/18 8:02 PM, remy.n...@blade-group.com wrote: From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL c

[Qemu-devel] [QEMU-devel][PATCH v2] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-12-06 Thread remy . noel
From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. This changes set_fd_handlers so that it no longer modify existing handlers entries and

Re: [Qemu-devel] util/aio-posix: Use RCU for handler insertion.

2018-12-06 Thread Remy NOEL
I did some tests and noticed the second and third patch to incur some performance loss (on a scenario using virtio device) I will therefore resubmit just the first patch alone. On 11/16/18 8:02 PM, remy.n...@blade-group.com wrote: From: Remy Noel get rid of the delete attribute. We still

[Qemu-devel] util/aio-posix: Use RCU for handler insertion.

2018-11-16 Thread remy . noel
From: Remy Noel get rid of the delete attribute. We still need to get rid of the context list lock. Signed-off-by: Remy Noel --- util/aio-posix.c | 75 ++-- util/aio-win32.c | 43 ++- 2 files changed, 49 insertions(+), 69

[Qemu-devel] [PATCH] aio_poll race condition.

2018-11-16 Thread remy . noel
From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. We fixes that by using an remove/insert RCU scheme. Please note that i did not test the win32

[Qemu-devel] aio: Do not use list_lock as a sync mechanism for aio_handlers anymore.

2018-11-16 Thread remy . noel
From: Remy Noel It is still used for bottom halves though and to avoid concurent set_fd_handlers (We could probably decorrelate the two, but set_fd_handlers are quite rare so it probably isn't worth it). Signed-off-by: Remy Noel --- include/block/aio.h | 4 +++- util/aio-posix.c

[Qemu-devel] aio-posix: Fix concurrent aio_poll/set_fd_handler.

2018-11-16 Thread remy . noel
From: Remy Noel We no longer modify existing handlers entries and instead, always insert those after having properly initialized those. Also, we do not call aio_epoll_update for deleted handlers as this has no impact whastoever. Signed-off-by: Remy Noel --- util/aio-posix.c | 85

[Qemu-devel] [PATCH v2] secondary-vga: delete mmio subregions upon exit

2018-10-02 Thread remy . noel
From: "remy.noel" 93abfc88bd649de1933588bfc7175605331b3ea9 introduced a reference cycle in the vga-pci devices, preventing cleanup of the object upon hotblug. This patch allows to break the cycle. Signed-off-by: remy.noel --- hw/display/vga-pci.c | 5 + 1 file changed, 5 insertions(+) di

Re: [Qemu-devel] [PATCH] secondary-vga: unregister vram on unplug.

2018-10-02 Thread Remy NOEL
iry those further though as the subregions removal did lead to a clean state. Remy Noel

Re: [Qemu-devel] [PATCH] secondary-vga: unregister vram on unplug.

2018-08-11 Thread Remy NOEL
On 08/07/2018 05:09 PM, Dr. David Alan Gilbert wrote: * Peter Maydell (peter.mayd...@linaro.org) wrote: On 7 August 2018 at 15:57, Dr. David Alan Gilbert wrote: * Gerd Hoffmann (kra...@redhat.com) wrote: On Fri, Jul 20, 2018 at 10:19:48AM +0200, remy.n...@blade-group.com wrote: From: "

[Qemu-devel] [PATCH] secondary-vga: unregister vram on unplug.

2018-07-20 Thread remy . noel
From: "Remy Noel" When removing a secondary-vga device and then adding it back (or adding an other one), qemu aborts with: "RAMBlock ":00:02.0/vga.vram" already registered, abort!". It is caused by the vram staying registered, preventing vga replugg