[Stable-11.0.4 051/120] vhost: do not crash on ring map failure

From: "Michael S. Tsirkin" <[email protected]>

When vhost_commit() rebuilds the memory region table after a flatview
change, it revalidates cached host virtual addresses for active vring
parts. If a mapping is stale, QEMU abort().

This is not a security problem - only the priviledged guest
can control make it invalid - but not nice e.g. for driver debugging.

Let's call virtio_error() instead, marking the device as broken.

Fixes: 0ca1fd2d68 ("vhost: Simplify ring verification checks")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3783
Cc: Stefano Garzarella <[email protected]>
Cc: Dr. David Alan Gilbert <[email protected]>
Reported-by: Feifan Qian <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-ID: <71961a7dc157f552303aeea8c99a75c5e1ce904e.1784898432.git.mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
(cherry picked from commit 27806d2ddba2da97fb4137cba7d4172356c42914)
Signed-off-by: Michael Tokarev <[email protected]>

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index b9dc4ed13ba..623a17d650d 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -687,8 +687,9 @@ static void vhost_commit(MemoryListener *listener)
                        (void *)(uintptr_t)dev->mem->regions[i].userspace_addr,
                        dev->mem->regions[i].guest_phys_addr,
                        dev->mem->regions[i].memory_size)) {
-            error_report("Verify ring failure on region %d", i);
-            abort();
+            virtio_error(dev->vdev,
+                         "Verify ring failure on region %d", i);
+            goto out;
         }
     }
 
-- 
2.47.3