aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGreg Kurz <groug@kaod.org>2019-10-24 16:27:33 +0200
committerLaurent Vivier <lvivier@redhat.com>2019-11-18 11:50:25 +0100
commit0a83b47055246d3942084f03fc54731c4fb9b731 (patch)
tree15a0f96fe9cac621b126b962c1f8c5ea7089e225
parent35886de140b7ff781b775d2da5e7475e8a8cb4c6 (diff)
downloadqemu-0a83b47055246d3942084f03fc54731c4fb9b731.tar.gz
ppc: Skip partially initialized vCPUs in 'info pic'
CPU_FOREACH() can race with vCPU hotplug/unplug on sPAPR machines, ie. we may try to print out info about a vCPU with a NULL presenter pointer. Check that in order to prevent QEMU from crashing. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <157192725327.3146912.12047076483178652551.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-rw-r--r--hw/intc/xics.c11
-rw-r--r--hw/intc/xive.c11
2 files changed, 20 insertions, 2 deletions
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 5f746079be4..e7ac9ba618f 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -44,7 +44,16 @@
void icp_pic_print_info(ICPState *icp, Monitor *mon)
{
- int cpu_index = icp->cs ? icp->cs->cpu_index : -1;
+ int cpu_index;
+
+ /* Skip partially initialized vCPUs. This can happen on sPAPR when vCPUs
+ * are hot plugged or unplugged.
+ */
+ if (!icp) {
+ return;
+ }
+
+ cpu_index = icp->cs ? icp->cs->cpu_index : -1;
if (!icp->output) {
return;
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 952a461d532..75dce82fb20 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -523,9 +523,18 @@ static const char * const xive_tctx_ring_names[] = {
void xive_tctx_pic_print_info(XiveTCTX *tctx, Monitor *mon)
{
- int cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
+ int cpu_index;
int i;
+ /* Skip partially initialized vCPUs. This can happen on sPAPR when vCPUs
+ * are hot plugged or unplugged.
+ */
+ if (!tctx) {
+ return;
+ }
+
+ cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
+
if (kvm_irqchip_in_kernel()) {
Error *local_err = NULL;