virtio-serial: Close device completely
Linux closes stdout at the end of prom_init which triggers the FW quiesce
code which closes the virtio-serial instance. This misses stopping the
virtio queues. However this seemed working for a little longer (until the
Linux driver took over) till 300384f3dc68 which moved the VQ descriptors
around which caused use-after-free corruption.
This adds virtio_queue_term_vq(), cleanup in the forth driver and a few
checks.
Fixes: 300384f3dc68 ("virtio: Store queue descriptors in virtio_device")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
[groug: - fix changelog
- don't restore emit]
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
diff --git a/board-qemu/slof/virtio-serial.fs b/board-qemu/slof/virtio-serial.fs
index e307231..ac55ffc 100644
--- a/board-qemu/slof/virtio-serial.fs
+++ b/board-qemu/slof/virtio-serial.fs
@@ -21,6 +21,7 @@
: shutdown ( -- )
virtiodev virtio-serial-shutdown
FALSE to initialized?
+ 0 to virtiodev
;
: virtio-serial-term-emit
@@ -58,6 +59,7 @@
;
: write ( addr len -- actual )
+ virtiodev 0= IF nip EXIT THEN
tuck
0 ?DO
dup c@ virtiodev SWAP virtio-serial-putchar
@@ -68,6 +70,7 @@
: read ( addr len -- actual )
0= IF drop 0 EXIT THEN
+ virtiodev 0= IF nip EXIT THEN
virtiodev virtio-serial-haschar 0= IF 0 swap c! -2 EXIT THEN
virtiodev virtio-serial-getchar swap c! 1
;
diff --git a/lib/libvirtio/virtio-serial.c b/lib/libvirtio/virtio-serial.c
index d1503a4..92afb02 100644
--- a/lib/libvirtio/virtio-serial.c
+++ b/lib/libvirtio/virtio-serial.c
@@ -102,6 +102,10 @@
/* Quiesce device */
virtio_set_status(dev, VIRTIO_STAT_FAILED);
+ /* Stop queues */
+ virtio_queue_term_vq(dev, &dev->vq[TX_Q], TX_Q);
+ virtio_queue_term_vq(dev, &dev->vq[RX_Q], RX_Q);
+
/* Reset device */
virtio_reset_device(dev);
}
@@ -114,6 +118,9 @@
uint16_t last_used_idx, avail_idx;
struct vqs *vq = &dev->vq[TX_Q];
+ if (!vq->desc)
+ return 0;
+
avail_idx = virtio_modern16_to_cpu(dev, vq->avail->idx);
last_used_idx = vq->used->idx;
