Skip to content

Commit bb2ef9c

Browse files
author
GitHub Actions Bot
committed
[PATCH] hw/ufs: avoid double unref of wrapped scsi-hd
https://lore.kernel.org/qemu-devel/178019129273.471607.15668084929091826093@gmail.com --- From: Jia Jia <physicalmtea@gmail.com> To: qemu-devel@nongnu.org Cc: jeuk20.kim@samsung.com, qemu-stable@nongnu.org Subject: [PATCH] hw/ufs: avoid double unref of wrapped scsi-hd Date: Sun, 31 May 2026 09:34:52 +0800 Message-ID: <178019129273.471607.15668084929091826093@gmail.com> X-Mailer: python-smtplib Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::62b; envelope-from=physicalmtea@gmail.com; helo=mail-pl1-x62b.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development <qemu-devel.nongnu.org> List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>, <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe> List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel> List-Post: <mailto:qemu-devel@nongnu.org> List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help> List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>, <mailto:qemu-devel-request@nongnu.org?subject=subscribe> Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org ufs_init_scsi_device() creates an internal scsi-hd and adds it as a child of lu->bus. qdev_realize_and_unref() then drops the construction reference, leaving the bus child ownership to tear it down. ufs_lu_unrealize() still unrefs lu->scsi_dev directly. If the UFS controller is ejected through ACPI PCI hotplug, the scsi-hd object can be finalized there and then the bus child removal RCU callback later unrefs the same object again. Keep lu->scsi_dev as a borrowed pointer and clear it during unrealize without unreffing it. Add a qtest that ejects the UFS controller through the x86 ACPI PCI hotplug eject register. On an ASAN build, the test reproduces the UAF before the fix. Fixes: 096434f ("hw/ufs: Modify lu.c to share codes with SCSI subsystem") Cc: qemu-stable@nongnu.org Signed-off-by: Jia Jia <physicalmtea@gmail.com> --- hw/ufs/lu.c | 5 +---- tests/qtest/ufs-test.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c index f13fc6e..41593a7 100644 --- a/hw/ufs/lu.c +++ b/hw/ufs/lu.c @@ -516,10 +516,7 @@ static void ufs_lu_unrealize(DeviceState *dev) { UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); - if (lu->scsi_dev) { - object_unref(OBJECT(lu->scsi_dev)); - lu->scsi_dev = NULL; - } + lu->scsi_dev = NULL; } static void ufs_lu_class_init(ObjectClass *oc, const void *data) diff --git a/tests/qtest/ufs-test.c b/tests/qtest/ufs-test.c index f677896..0ae03c3 100644 --- a/tests/qtest/ufs-test.c +++ b/tests/qtest/ufs-test.c @@ -34,6 +34,8 @@ #define TEST_QID 0 #define QUEUE_SIZE 32 #define UFS_MCQ_MAX_QNUM 32 +#define ACPI_PCIHP_ADDR 0xae00 +#define PCI_EJ_BASE 0x0008 typedef struct QUfs QUfs; @@ -635,6 +637,17 @@ static void ufstest_reg_read(void *obj, void *data, QGuestAllocator *alloc) qpci_iounmap(&ufs->dev, ufs->bar); } +static void ufstest_acpi_eject(void *obj, void *data, QGuestAllocator *alloc) +{ + QUfs *ufs = obj; + QTestState *qts = ufs->dev.bus->qts; + + qtest_outl(qts, ACPI_PCIHP_ADDR + PCI_EJ_BASE, 1 << 4); + qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); + g_usleep(3 * G_USEC_PER_SEC); + qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); +} + static void ufstest_init(void *obj, void *data, QGuestAllocator *alloc) { QUfs *ufs = obj; @@ -1426,6 +1439,9 @@ static void ufs_register_nodes(void) g_test_message("Skipping ufs io tests for ppc64"); return; } + if (!strcmp(arch, "i386") || !strcmp(arch, "x86_64")) { + qos_add_test("acpi-eject", "ufs", ufstest_acpi_eject, NULL); + } qos_add_test("init", "ufs", ufstest_init, NULL); qos_add_test("legacy-read-write", "ufs", ufstest_read_write, &io_test_opts); qos_add_test("mcq-read-write", "ufs", ufstest_read_write, &mcq_test_opts); Signed-off-by: GitHub Actions Bot <bot@github.com>
1 parent f35b0f9 commit bb2ef9c

49 files changed

Lines changed: 886 additions & 3491 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/build.yml

Lines changed: 430 additions & 0 deletions
Large diffs are not rendered by default.

.github/workflows/containers.yml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
on:
2+
schedule:
3+
- cron: '0 6 * * *'
4+
workflow_dispatch:
5+
6+
permissions: write-all
7+
8+
jobs:
9+
build_container:
10+
runs-on: ubuntu-24.04
11+
strategy:
12+
fail-fast: false
13+
matrix:
14+
# cd tests/docker/dockerfiles/
15+
# ls *docker | sed -e 's/.docker//' | tr '\n' ','
16+
# remove: debian-bootstrap,debian-toolchain,debian,debian-all-test-cross,python
17+
container: [alpine,centos9,debian-amd64-cross,debian-arm64-cross,debian-armhf-cross,debian-hexagon-cross,debian-i686-cross,debian-loongarch-cross,debian-ppc64el-cross,debian-riscv64-cross,debian-s390x-cross,debian-tricore-cross,debian-xtensa-cross,fedora,fedora-rust-nightly,fedora-win64-cross,ubuntu2204]
18+
steps:
19+
- uses: actions/checkout@v6
20+
- run: podman build -t docker.io/pboqemu/qemu-ci:${{matrix.container}} - < tests/docker/dockerfiles/${{matrix.container}}.docker
21+
- run: podman login -u pboqemu -p ${{secrets.DOCKERHUB_PASSWORD}}
22+
- run: podman push docker.io/pboqemu/qemu-ci:${{matrix.container}}
23+
24+
build_container_debian_per_arch:
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- runner: ubuntu-24.04-arm
30+
arch: arm64
31+
- runner: ubuntu-24.04
32+
arch: amd64
33+
runs-on: ${{matrix.runner}}
34+
steps:
35+
# we clean up runner first, to get more disk space
36+
- run: sudo swapoff -a && sudo rm -f /mnt/swapfile
37+
- run: sudo rm -rf /opt/ /usr/local/.ghcup /usr/local/lib/android /usr/lib/google-cloud-sdk /usr/lib/jvm /usr/share/dotnet /usr/share/swift /usr/local/julia* /usr/local/share/powershell
38+
- run: docker system prune -af
39+
- run: df -ah
40+
- uses: actions/checkout@v6
41+
- run: podman build -t qemu/debian --platform linux/${{matrix.arch}} - < tests/docker/dockerfiles/debian.docker
42+
# add cross compilers and cache test assets
43+
- run: podman run -it -v $(pwd):$(pwd) -w $(pwd) qemu/debian ./build_ci_container.sh
44+
- run: podman commit "$(podman ps -aq)" --change CMD=/bin/bash docker.io/pboqemu/qemu-ci:debian.${{matrix.arch}}
45+
- run: podman login -u pboqemu -p ${{secrets.DOCKERHUB_PASSWORD}}
46+
- run: podman push docker.io/pboqemu/qemu-ci:debian.${{matrix.arch}}
47+
48+
build_container_debian:
49+
needs: build_container_debian_per_arch
50+
runs-on: ubuntu-24.04
51+
steps:
52+
# assemble multi arch image
53+
- run: podman manifest create docker.io/pboqemu/qemu-ci:debian --amend docker.io/pboqemu/qemu-ci:debian.amd64 --amend docker.io/pboqemu/qemu-ci:debian.arm64
54+
- run: podman login -u pboqemu -p ${{secrets.DOCKERHUB_PASSWORD}}
55+
- run: podman push docker.io/pboqemu/qemu-ci:debian

.github/workflows/new_series.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
on:
2+
schedule:
3+
- cron: '*/20 * * * *'
4+
workflow_dispatch:
5+
6+
permissions: write-all
7+
8+
jobs:
9+
push_new_series:
10+
runs-on: ubuntu-24.04
11+
concurrency:
12+
group: push_new_series
13+
cancel-in-progress: true
14+
steps:
15+
- name: checkout
16+
uses: actions/checkout@v6
17+
with:
18+
# a PAT must be generated with workflow permission, else it's not
19+
# possible to push any change for those files
20+
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/triggering-a-workflow#triggering-a-workflow-from-a-workflow
21+
token: ${{ secrets.WORKFLOW_COMMIT_TOKEN }}
22+
- run: git fetch -a origin --unshallow || true
23+
- run: git config user.name "GitHub Actions Bot"
24+
- run: git config user.email "<bot@github.com>"
25+
- run: git config advice.detachedHead false
26+
- run: sudo pip install b4
27+
- run: ./push_new_series.sh

.github/workflows/upstream.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
on:
2+
schedule:
3+
- cron: '0 */30 * * *'
4+
workflow_dispatch:
5+
6+
permissions: write-all
7+
8+
jobs:
9+
push_upstream:
10+
runs-on: ubuntu-24.04
11+
steps:
12+
- uses: actions/checkout@v6
13+
- run: git fetch -a origin --unshallow || true
14+
- run: git config user.name "GitHub Actions Bot"
15+
- run: git config user.email "<bot@github.com>"
16+
- run: git remote add upstream -f https://gitlab.com/qemu-project/qemu
17+
- run: git checkout -b master || git checkout master
18+
- run: git reset --hard upstream/master
19+
- run: git merge origin/ci --squash --ff
20+
- run: mv .github/workflows/build.yml build.yml && git rm -f .github/workflows/* && mkdir -p .github/workflows/ && mv build.yml .github/workflows/ && git add .github
21+
- run: git commit -a -m 'ci' --signoff
22+
- run: git push -f --set-upstream origin master

README.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
QEMU CI
2+
=======
3+
4+
This repository is a downstream fork of
5+
[QEMU](https://gitlab.com/qemu-project/qemu), testing all patches posted on
6+
[mailing list](https://lore.kernel.org/qemu-devel).
7+
8+
All series are pushed as branches (using message-id as name), and tested.
9+
As well, master branch is continuously updated to match upstream.
10+
11+
Series status can be checked on
12+
[this page](https://github.com/p-b-o/qemu-ci/branches/all).
13+
14+
Disclaimer: This is not a project supported by upstream QEMU. It's provided as a
15+
convenience to help you check status of series and apply easily an existing
16+
series by fetching associated branch.
17+
18+
---
19+
20+
To use it on your fork:
21+
22+
```
23+
git remote add qemu-ci https://github.com/p-b-o/qemu-ci
24+
git fetch qemu-ci master
25+
git cherry-pick qemu-ci/master
26+
# and enable Actions on your GitHub repository
27+
```
28+
29+
Note: qemu-ci/master is continuously updated with hot fixes for CI, so it's
30+
better to reapply it every time you rebase your personal branch.
31+
32+
---
33+
34+
[CI yaml file](https://github.com/p-b-o/qemu-ci/blob/ci/.github/workflows/build.yml)
35+
has been written to be self contained, to use containers and to be as explicit
36+
as possible. As a result, it is fairly easy to take any command and run it on
37+
your machine.
38+
39+
In case you want to reproduce the exact same environment as GitHub, you can use
40+
[github-runners](https://github.com/second-reality/github-runners), which
41+
provides convenient ssh access to all runners GitHub offers.

README.rst

Lines changed: 1 addition & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -1,171 +1 @@
1-
===========
2-
QEMU README
3-
===========
4-
5-
QEMU is a generic and open source machine & userspace emulator and
6-
virtualizer.
7-
8-
QEMU is capable of emulating a complete machine in software without any
9-
need for hardware virtualization support. By using dynamic translation,
10-
it achieves very good performance. QEMU can also integrate with the Xen
11-
and KVM hypervisors to provide emulated hardware while allowing the
12-
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
13-
near native performance for CPUs. When QEMU emulates CPUs directly it is
14-
capable of running operating systems made for one machine (e.g. an ARMv7
15-
board) on a different machine (e.g. an x86_64 PC board).
16-
17-
QEMU is also capable of providing userspace API virtualization for Linux
18-
and BSD kernel interfaces. This allows binaries compiled against one
19-
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
20-
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
21-
involve any hardware emulation, simply CPU and syscall emulation.
22-
23-
QEMU aims to fit into a variety of use cases. It can be invoked directly
24-
by users wishing to have full control over its behaviour and settings.
25-
It also aims to facilitate integration into higher level management
26-
layers, by providing a stable command line interface and monitor API.
27-
It is commonly invoked indirectly via the libvirt library when using
28-
open source applications such as oVirt, OpenStack and virt-manager.
29-
30-
QEMU as a whole is released under the GNU General Public License,
31-
version 2. For full licensing details, consult the LICENSE file.
32-
33-
34-
Documentation
35-
=============
36-
37-
Documentation can be found hosted online at
38-
`<https://www.qemu.org/documentation/>`_. The documentation for the
39-
current development version that is available at
40-
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
41-
folder in the source tree, and is built by `Sphinx
42-
<https://www.sphinx-doc.org/en/master/>`_.
43-
44-
45-
Building
46-
========
47-
48-
QEMU is multi-platform software intended to be buildable on all modern
49-
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
50-
of other UNIX targets. The simple steps to build QEMU are:
51-
52-
53-
.. code-block:: shell
54-
55-
mkdir build
56-
cd build
57-
../configure
58-
make
59-
60-
Additional information can also be found online via the QEMU website:
61-
62-
* `<https://wiki.qemu.org/Hosts/Linux>`_
63-
* `<https://wiki.qemu.org/Hosts/Mac>`_
64-
* `<https://wiki.qemu.org/Hosts/W32>`_
65-
66-
67-
Submitting patches
68-
==================
69-
70-
The QEMU source code is maintained under the GIT version control system.
71-
72-
.. code-block:: shell
73-
74-
git clone https://gitlab.com/qemu-project/qemu.git
75-
76-
When submitting patches, one common approach is to use 'git
77-
format-patch' and/or 'git send-email' to format & send the mail to the
78-
qemu-devel@nongnu.org mailing list. All patches submitted must contain
79-
a 'Signed-off-by' line from the author. Patches should follow the
80-
guidelines set out in the `style section
81-
<https://www.qemu.org/docs/master/devel/style.html>`_ of
82-
the Developers Guide.
83-
84-
Additional information on submitting patches can be found online via
85-
the QEMU website:
86-
87-
* `<https://wiki.qemu.org/Contribute/SubmitAPatch>`_
88-
* `<https://wiki.qemu.org/Contribute/TrivialPatches>`_
89-
90-
The QEMU website is also maintained under source control.
91-
92-
.. code-block:: shell
93-
94-
git clone https://gitlab.com/qemu-project/qemu-web.git
95-
96-
* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_
97-
98-
A 'git-publish' utility was created to make above process less
99-
cumbersome, and is highly recommended for making regular contributions,
100-
or even just for sending consecutive patch series revisions. It also
101-
requires a working 'git send-email' setup, and by default doesn't
102-
automate everything, so you may want to go through the above steps
103-
manually for once.
104-
105-
For installation instructions, please go to:
106-
107-
* `<https://github.com/stefanha/git-publish>`_
108-
109-
The workflow with 'git-publish' is:
110-
111-
.. code-block:: shell
112-
113-
$ git checkout master -b my-feature
114-
$ # work on new commits, add your 'Signed-off-by' lines to each
115-
$ git publish
116-
117-
Your patch series will be sent and tagged as my-feature-v1 if you need to refer
118-
back to it in the future.
119-
120-
Sending v2:
121-
122-
.. code-block:: shell
123-
124-
$ git checkout my-feature # same topic branch
125-
$ # making changes to the commits (using 'git rebase', for example)
126-
$ git publish
127-
128-
Your patch series will be sent with 'v2' tag in the subject and the git tip
129-
will be tagged as my-feature-v2.
130-
131-
Bug reporting
132-
=============
133-
134-
The QEMU project uses GitLab issues to track bugs. Bugs
135-
found when running code built from QEMU git or upstream released sources
136-
should be reported via:
137-
138-
* `<https://gitlab.com/qemu-project/qemu/-/issues>`_
139-
140-
If using QEMU via an operating system vendor pre-built binary package, it
141-
is preferable to report bugs to the vendor's own bug tracker first. If
142-
the bug is also known to affect latest upstream code, it can also be
143-
reported via GitLab.
144-
145-
For additional information on bug reporting consult:
146-
147-
* `<https://wiki.qemu.org/Contribute/ReportABug>`_
148-
149-
150-
ChangeLog
151-
=========
152-
153-
For version history and release notes, please visit
154-
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
155-
more detailed information.
156-
157-
158-
Contact
159-
=======
160-
161-
The QEMU community can be contacted in a number of ways, with the two
162-
main methods being email and IRC:
163-
164-
* `<mailto:qemu-devel@nongnu.org>`_
165-
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
166-
* #qemu on irc.oftc.net
167-
168-
Information on additional methods of contacting the community can be
169-
found online via the QEMU website:
170-
171-
* `<https://wiki.qemu.org/Contribute/StartHere>`_
1+
This file must exists for ./scripts/checkpatch.pl to say it's a correct tree.

build_ci_container.sh

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/usr/bin/env bash
2+
# SPDX-License-Identifier: GPL-2.0-or-later
3+
4+
set -euo pipefail
5+
set -x
6+
7+
echo "Install gdb"
8+
apt update
9+
apt install -y gdb-multiarch gdb
10+
11+
echo "Install cross compilers"
12+
apt update
13+
apt install -y \
14+
gcc-aarch64-linux-gnu \
15+
libc6-dev-arm64-cross \
16+
gcc-arm-linux-gnueabihf \
17+
libc6-dev-armhf-cross \
18+
gcc-alpha-linux-gnu \
19+
libc6.1-dev-alpha-cross \
20+
gcc-mips-linux-gnu \
21+
libc6-dev-mips-cross \
22+
gcc-mips64-linux-gnuabi64 \
23+
libc6-dev-mips64-cross \
24+
gcc-mips64el-linux-gnuabi64 \
25+
libc6-dev-mips64el-cross \
26+
gcc-mipsel-linux-gnu \
27+
libc6-dev-mipsel-cross \
28+
gcc-powerpc64le-linux-gnu \
29+
libc6-dev-ppc64el-cross \
30+
gcc-riscv64-linux-gnu \
31+
libc6-dev-riscv64-cross \
32+
gcc-s390x-linux-gnu \
33+
libc6-dev-s390x-cross \
34+
gcc-sh4-linux-gnu \
35+
libc6-dev-sh4-cross
36+
37+
echo "Install additional cross compilers (not available on arm)"
38+
if dpkg-architecture -e amd64; then
39+
apt update
40+
apt install -y \
41+
gcc-hppa-linux-gnu \
42+
libc6-dev-hppa-cross \
43+
gcc-m68k-linux-gnu \
44+
libc6-dev-m68k-cross \
45+
gcc-powerpc-linux-gnu \
46+
libc6-dev-powerpc-cross \
47+
gcc-powerpc64-linux-gnu \
48+
libc6-dev-ppc64-cross \
49+
gcc-sparc64-linux-gnu \
50+
libc6-dev-sparc64-cross
51+
fi
52+
53+
echo "Precache tests data"
54+
./configure
55+
ninja -C build precache-functional -k 0 || true
56+
ninja -C build precache-functional -j1 -k 0

configure

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,12 +1298,12 @@ fi
12981298
# functions to probe cross compilers
12991299

13001300
runc="no"
1301-
if test $use_containers = "yes" && (has "docker" || has "podman"); then
1302-
runc=$($python "$source_path"/tests/docker/docker.py --engine "$container_engine" probe)
1303-
if test "$runc" != "no"; then
1304-
docker_py="$python $source_path/tests/docker/docker.py --engine $container_engine"
1305-
fi
1306-
fi
1301+
#if test $use_containers = "yes" && (has "docker" || has "podman"); then
1302+
# runc=$($python "$source_path"/tests/docker/docker.py --engine "$container_engine" probe)
1303+
# if test "$runc" != "no"; then
1304+
# docker_py="$python $source_path/tests/docker/docker.py --engine $container_engine"
1305+
# fi
1306+
#fi
13071307

13081308
# cross compilers defaults, can be overridden with --cross-cc-ARCH
13091309
: ${cross_prefix_aarch64="aarch64-linux-gnu-"}

0 commit comments

Comments
 (0)