Red Hat Bugzilla – Bug 628805
Fix hot-unplug handling of virtio-console ports
Last modified: 2013-07-25 05:08:44 EDT
The current version of virtio-console doesn't handle hot-unplug properly: it leads to accessing memory outside the driver's memory area and can cause guest kernel panics. There are a few ways to trigger this, one of them: 1. Open a virtio-console port in the guest (eg /dev/vport0p1) 2. Block the port on read (eg cat /dev/vport0p1 with host chardev connected) 3. Hot-unplug the port (using the device_del command for the qemu monitor) 4. Close the port in the guest Patches are queued for inclusion upstream. The patches also should be backported to 6.0 z-stream kernel. Note that by default only root is allowed to open a virtio-console port, so this can't be triggered by an unprivileged user in the default setup.
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
Patch(es) available on kernel-2.6.32-89.el6
Reproduced in kernel 2.6.32-83.el6.x86_64 steps: 1. start guest with cmd 2. run the following in host #dd if=/dev/sda bs=1M count=1024|nc -U /home/rhel6.channel0 3. block the port on read in guest # cat /dev/vport0p1 4. hot-unplug the port in monitor during the date transferring (qemu) device_del port1 cmd: /usr/libexec/qemu-kvm -m 2G -smp 2 -uuid `uuidgen` -rtc base=utc,clock=host,driftfix=slew -boot c -drive file=/home/image/rhel6.qcow2,index=0,if=none,id=drive-virtio-disk1,media=disk,cache=none,format=qcow2 -device virtio-blk-pci,bus=pci.0,drive=drive-virtio-disk1,id=virtio-disk0 -netdev tap,id=hostnet0,script=/etc/qemu-ifup-switch -device virtio-net-pci,netdev=hostnet0,mac=00:10:12:20:77:0c,bus=pci.0,addr=0x7,id=hostnet0 -monitor stdio -vnc :1 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,bus=pci.0,addr=0x4 -chardev socket,id=channel0,path=/home/rhel6.channel0,server,nowait -device virtserialport,chardev=channel0,name=org.linux-kvm.port.0,bus=virtio-serial0.0,id=port1 Verified in kernel 2.6.32-89.el6.x86_64. The guest running normally after hot-unplug the virito-serial port during data transferring.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: The virtio-console device did not handle the hot-unplug operation properly. As a result, virtio-console could access the memory outside the driver's memory area and cause kernel panic on the guest. With this update, multiple fixes to the virtio-console device resolved this issue and the hot-unplug operation works as expected.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0542.html