2746ce73b5
- Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577) e1000-fail-early-for-evil-descriptor.patch - Fix incorrect guest data in s390x PCI passthrough (bsc#1183372) s390x-pci-restore-missing-Query-PCI-Func.patch - Include upstream patches designated as stable material and reviewed for applicability to include here lsilogic-Use-PCIDevice-exit-instead-of-D.patch vhost-user-blk-fix-blkcfg-num_queues-end.patch - Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137) 9pfs-Fully-restart-unreclaim-loop-CVE-20.patch - Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639) net-vmxnet3-validate-configuration-value.patch OBS-URL: https://build.opensuse.org/request/show/879536 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=629
53 lines
2.1 KiB
Diff
53 lines
2.1 KiB
Diff
From: Peng Liang <liangpeng10@huawei.com>
|
|
Date: Tue, 2 Mar 2021 21:30:16 +0800
|
|
Subject: lsilogic: Use PCIDevice::exit instead of DeviceState::unrealize
|
|
|
|
Git-commit: faabca42cc4ff51110116dfe44d420c668b4d8d8
|
|
|
|
PCI_DEVICE has overwritten DeviceState::unrealize (pci_qdev_unrealize).
|
|
However, LSI53C895A, which is a subclass of PCI_DEVICE, overwrites it
|
|
again and doesn't save the parent's implementation so the PCI_DEVICE's
|
|
implementation of DeviceState::unrealize will never be called when
|
|
unrealize a LSI53C895A device. And it will lead to memory leak and
|
|
unplug failure.
|
|
|
|
For a PCI device, it's better to implement PCIDevice::exit instead of
|
|
DeviceState::unrealize. So let's change to use PCIDevice::exit.
|
|
|
|
Fixes: a8632434c7e9 ("lsi: implement I/O memory space for Memory Move instructions")
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
|
|
Message-Id: <20210302133016.1221081-1-liangpeng10@huawei.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/scsi/lsi53c895a.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
|
|
index 7d13c7dc1c46e8a32ed0e3e090ff..af46c62f0d78268b52d19ca9fd07 100644
|
|
--- a/hw/scsi/lsi53c895a.c
|
|
+++ b/hw/scsi/lsi53c895a.c
|
|
@@ -2312,7 +2312,7 @@ static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
|
|
scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
|
|
}
|
|
|
|
-static void lsi_scsi_unrealize(DeviceState *dev)
|
|
+static void lsi_scsi_exit(PCIDevice *dev)
|
|
{
|
|
LSIState *s = LSI53C895A(dev);
|
|
|
|
@@ -2325,11 +2325,11 @@ static void lsi_class_init(ObjectClass *klass, void *data)
|
|
PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
|
|
|
|
k->realize = lsi_scsi_realize;
|
|
+ k->exit = lsi_scsi_exit;
|
|
k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
|
|
k->device_id = PCI_DEVICE_ID_LSI_53C895A;
|
|
k->class_id = PCI_CLASS_STORAGE_SCSI;
|
|
k->subsystem_id = 0x1000;
|
|
- dc->unrealize = lsi_scsi_unrealize;
|
|
dc->reset = lsi_scsi_reset;
|
|
dc->vmsd = &vmstate_lsi_scsi;
|
|
set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
|