File 0287-main-loop.h-introduce-qemu_in_main_.patch of Package qemu

From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Date: Thu, 3 Mar 2022 10:15:46 -0500
Subject: main-loop.h: introduce qemu_in_main_thread() (bsc#1229007,
 bsc#1245423, CVE-2024-7409)

When invoked from the main loop, this function is the same
as qemu_mutex_iothread_locked, and returns true if the BQL is held.
When invoked from iothreads or tests, it returns true only
if the current AioContext is the Main Loop.

This essentially just extends qemu_mutex_iothread_locked to work
also in unit tests or other users like storage-daemon, that run
in the Main Loop but end up using the implementation in
stubs/iothread-lock.c.

Using qemu_mutex_iothread_locked in unit tests defaults to false
because they use the implementation in stubs/iothread-lock,
making all assertions added in next patches fail despite the
AioContext is still the main loop.

See the comment in the function header for more information.

Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Message-Id: <20220303151616.325444-2-eesposit@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 6538692e2802666926e62d9309ddddda5ec9dc3b)
References: bsc#1229007, bsc#1245423
References: CVE-2024-7409
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
Signed-off-by: Lin Ma <lma@suse.de>
---
 cpus.c                      |  5 +++++
 include/qemu/main-loop.h    | 24 ++++++++++++++++++++++++
 stubs/Makefile.objs         |  1 +
 stubs/iothread-lock-block.c |  7 +++++++
 4 files changed, 37 insertions(+)

diff --git a/cpus.c b/cpus.c
index 0ddeeefc14f18da10a0a76919bcc..680d4e0cc4feb2633963c6ed8a0d 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1837,6 +1837,11 @@ bool qemu_mutex_iothread_locked(void)
     return iothread_locked;
 }
 
+bool qemu_in_main_thread(void)
+{
+    return qemu_mutex_iothread_locked();
+}
+
 /*
  * The BQL is taken from so many places that it is worth profiling the
  * callers directly, instead of funneling them all through a single function.
diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index e59f9ae1e9df7753da4ccbc3133b..8f80d376a7717ffbcf6894375cce 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -260,9 +260,33 @@ int qemu_add_child_watch(pid_t pid);
  * must always be taken outside other locks.  This function helps
  * functions take different paths depending on whether the current
  * thread is running within the main loop mutex.
+ *
+ * This function should never be used in the block layer, because
+ * unit tests, block layer tools and qemu-storage-daemon do not
+ * have a BQL.
+ * Please instead refer to qemu_in_main_thread().
  */
 bool qemu_mutex_iothread_locked(void);
 
+/**
+ * qemu_in_main_thread: return whether it's possible to safely access
+ * the global state of the block layer.
+ *
+ * Global state of the block layer is not accessible from I/O threads
+ * or worker threads; only from threads that "own" the default
+ * AioContext that qemu_get_aio_context() returns.  For tests, block
+ * layer tools and qemu-storage-daemon there is a designated thread that
+ * runs the event loop for qemu_get_aio_context(), and that is the
+ * main thread.
+ *
+ * For emulators, however, any thread that holds the BQL can act
+ * as the block layer main thread; this will be any of the actual
+ * main thread, the vCPU threads or the RCU thread.
+ *
+ * For clarity, do not use this function outside the block layer.
+ */
+bool qemu_in_main_thread(void);
+
 /**
  * qemu_mutex_lock_iothread: Lock the main loop mutex.
  *
diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
index 5dd0aeeec69c5589c8d9a5ac53dd..1a1f4c2bfdfedae396f7910112f5 100644
--- a/stubs/Makefile.objs
+++ b/stubs/Makefile.objs
@@ -15,6 +15,7 @@ stub-obj-y += gdbstub.o
 stub-obj-y += get-vm-name.o
 stub-obj-y += iothread.o
 stub-obj-y += iothread-lock.o
+stub-obj-y += iothread-lock-block.o
 stub-obj-y += is-daemonized.o
 stub-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
 stub-obj-y += machine-init-done.o
diff --git a/stubs/iothread-lock-block.c b/stubs/iothread-lock-block.c
new file mode 100644
index 0000000000000000000000000000000000000000..def2a0579dde257a6088875c86af9c8bda6d6a85
--- /dev/null
+++ b/stubs/iothread-lock-block.c
@@ -0,0 +1,7 @@
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+
+bool qemu_in_main_thread(void)
+{
+    return qemu_get_current_aio_context() == qemu_get_aio_context();
+}