File main-loop.h-introduce-qemu_in_main_threa.patch of Package qemu.40154

From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Date: Thu, 3 Mar 2022 10:15:46 -0500
Subject: main-loop.h: introduce qemu_in_main_thread() (bsc#1229007,
 CVE-2024-7409)

When invoked from the main loop, this function is the same
as qemu_mutex_iothread_locked, and returns true if the BQL is held.
When invoked from iothreads or tests, it returns true only
if the current AioContext is the Main Loop.

This essentially just extends qemu_mutex_iothread_locked to work
also in unit tests or other users like storage-daemon, that run
in the Main Loop but end up using the implementation in
stubs/iothread-lock.c.

Using qemu_mutex_iothread_locked in unit tests defaults to false
because they use the implementation in stubs/iothread-lock,
making all assertions added in next patches fail despite the
AioContext is still the main loop.

See the comment in the function header for more information.

Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Message-Id: <20220303151616.325444-2-eesposit@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 6538692e2802666926e62d9309ddddda5ec9dc3b)
References: bsc#1229007
References: CVE-2024-7409
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
---
 cpus.c                      |  5 +++++
 include/qemu/main-loop.h    | 24 ++++++++++++++++++++++++
 stubs/Makefile.objs         |  1 +
 stubs/iothread-lock-block.c |  8 ++++++++
 4 files changed, 38 insertions(+)

diff --git a/cpus.c b/cpus.c
index 63bda152f5743d4cbb80512b996c..8a2af172d77a49616d68b925df05 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1887,6 +1887,11 @@ bool qemu_mutex_iothread_locked(void)
     return iothread_locked;
 }
 
+bool qemu_in_main_thread(void)
+{
+    return qemu_mutex_iothread_locked();
+}
+
 /*
  * The BQL is taken from so many places that it is worth profiling the
  * callers directly, instead of funneling them all through a single function.
diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index f6ba78ea73959d5ce0cb4269e5f7..502097a25cb309a6e0d3ac5f445f 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -260,9 +260,33 @@ int qemu_add_child_watch(pid_t pid);
  * must always be taken outside other locks.  This function helps
  * functions take different paths depending on whether the current
  * thread is running within the main loop mutex.
+ *
+ * This function should never be used in the block layer, because
+ * unit tests, block layer tools and qemu-storage-daemon do not
+ * have a BQL.
+ * Please instead refer to qemu_in_main_thread().
  */
 bool qemu_mutex_iothread_locked(void);
 
+/**
+ * qemu_in_main_thread: return whether it's possible to safely access
+ * the global state of the block layer.
+ *
+ * Global state of the block layer is not accessible from I/O threads
+ * or worker threads; only from threads that "own" the default
+ * AioContext that qemu_get_aio_context() returns.  For tests, block
+ * layer tools and qemu-storage-daemon there is a designated thread that
+ * runs the event loop for qemu_get_aio_context(), and that is the
+ * main thread.
+ *
+ * For emulators, however, any thread that holds the BQL can act
+ * as the block layer main thread; this will be any of the actual
+ * main thread, the vCPU threads or the RCU thread.
+ *
+ * For clarity, do not use this function outside the block layer.
+ */
+bool qemu_in_main_thread(void);
+
 /**
  * qemu_mutex_lock_iothread: Lock the main loop mutex.
  *
diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
index 4a50e95ec3e9c5e25ff2677b3764..f072f9cb5811ca20774a3bbf2796 100644
--- a/stubs/Makefile.objs
+++ b/stubs/Makefile.objs
@@ -11,6 +11,7 @@ stub-obj-y += gdbstub.o
 stub-obj-y += get-vm-name.o
 stub-obj-y += iothread.o
 stub-obj-y += iothread-lock.o
+stub-obj-y += iothread-lock-block.o
 stub-obj-y += is-daemonized.o
 stub-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
 stub-obj-y += machine-init-done.o
diff --git a/stubs/iothread-lock-block.c b/stubs/iothread-lock-block.c
new file mode 100644
index 0000000000000000000000000000000000000000..c88ed70462514bf65ca98e9e749f387901f5cbc4
--- /dev/null
+++ b/stubs/iothread-lock-block.c
@@ -0,0 +1,8 @@
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+
+bool qemu_in_main_thread(void)
+{
+    return qemu_get_current_aio_context() == qemu_get_aio_context();
+}
+