virtio/vhost: reset dev->log after syncing

vhost_log_put() is called to decomission the dirty log between qemu and a vhost device when stopping the device. Such a call can happen from migration_completion(). Present code sets dev->log_size to zero too early in vhost_log_put(), causing the sync check to always return false. As a consequence, the last pass on the dirty bitmap never happens at the end of migration. If a vhost device was busy (writing to guest memory) until the last moments before vhost_virtqueue_stop(), this error will result in guest memory corruption (at least) following migrations. Signed-off-by: Felipe Franciosi <[email protected]> Acked-by: Jason Wang <[email protected]> Reviewed-by: Marc-André Lureau <[email protected]> Reviewed-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]>
borntraeger · Oct 15, 2017 · 5c0ba1b · 5c0ba1b
1 parent 3505a22
commit 5c0ba1b
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
@@ -375,8 +375,6 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync)
     if (!log) {
         return;
     }
-    dev->log = NULL;
-    dev->log_size = 0;
 
     --log->refcnt;
     if (log->refcnt == 0) {
@@ -396,6 +394,9 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync)
 
         g_free(log);
     }
+
+    dev->log = NULL;
+    dev->log_size = 0;
 }
 
 static bool vhost_dev_log_is_shared(struct vhost_dev *dev)