Bug 628805

The current version of virtio-console doesn't handle hot-unplug properly: it
leads to accessing memory outside the driver's memory area and can cause guest kernel panics.

There are a few ways to trigger this, one of them:

1. Open a virtio-console port in the guest (eg /dev/vport0p1)
2. Block the port on read (eg cat /dev/vport0p1 with host chardev connected)
3. Hot-unplug the port (using the device_del command for the qemu monitor)
4. Close the port in the guest

Patches are queued for inclusion upstream.

The patches also should be backported to 6.0 z-stream kernel.

Note that by default only root is allowed to open a virtio-console port, so
this can't be triggered by an unprivileged user in the default setup.

This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux maintenance release. Product Management has 
requested further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed 
products. This request is not yet committed for inclusion in an Update release.

Patch(es) available on kernel-2.6.32-89.el6

Reproduced in kernel 2.6.32-83.el6.x86_64

steps:
1. start guest with cmd
2. run the following in host
#dd if=/dev/sda bs=1M count=1024|nc -U /home/rhel6.channel0
3. block the port on read in guest 
# cat /dev/vport0p1 
4. hot-unplug the port in monitor during the date transferring
(qemu) device_del port1

cmd:
/usr/libexec/qemu-kvm -m 2G -smp 2  -uuid `uuidgen` -rtc base=utc,clock=host,driftfix=slew -boot c -drive file=/home/image/rhel6.qcow2,index=0,if=none,id=drive-virtio-disk1,media=disk,cache=none,format=qcow2 -device virtio-blk-pci,bus=pci.0,drive=drive-virtio-disk1,id=virtio-disk0 -netdev tap,id=hostnet0,script=/etc/qemu-ifup-switch -device virtio-net-pci,netdev=hostnet0,mac=00:10:12:20:77:0c,bus=pci.0,addr=0x7,id=hostnet0 -monitor stdio -vnc :1 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,bus=pci.0,addr=0x4 -chardev socket,id=channel0,path=/home/rhel6.channel0,server,nowait -device virtserialport,chardev=channel0,name=org.linux-kvm.port.0,bus=virtio-serial0.0,id=port1

Verified in kernel 2.6.32-89.el6.x86_64.

The guest running normally after hot-unplug the virito-serial port during data transferring.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The virtio-console device did not handle the hot-unplug operation properly. As a result, virtio-console could access the memory outside the driver's memory area and cause kernel panic on the guest. With this update, multiple fixes to the virtio-console device resolved this issue and the hot-unplug operation works as expected.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0542.html