From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 23:02:03 +0000 (-0700)
Subject: accel/tcg: Properly unlink a TB linked to itself
X-Git-Tag: v7.2.21~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6da5cadbdaa408dec8e001a0bfbd147598466f97;p=thirdparty%2Fqemu.git

accel/tcg: Properly unlink a TB linked to itself

When we remove dest from orig's links, we lose the link
that we rely on later to reset links.  This can lead to
failure to release from spinlock with self-modifying code.

Cc: qemu-stable@nongnu.org
Reported-by: 李威威 <liweiwei@kubuds.cn>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Tested-by: Anton Johansson <anjo@rev.ng>
(cherry picked from commit 03fe6659803f83690b8587d01f8ee56bb4be4b90)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 9d9f651c78e..077265172e5 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -186,6 +186,14 @@ static inline void tb_remove_from_jmp_list(TranslationBlock *orig, int n_orig)
      * We first acquired the lock, and since the destination pointer matches,
      * we know for sure that @orig is in the jmp list.
      */
+    if (dest == orig) {
+        /*
+         * In the case of a TB that links to itself, removing the entry
+         * from the list means that it won't be present later during
+         * tb_jmp_unlink -- unlink now.
+         */
+        tb_reset_jump(orig, n_orig);
+    }
     pprev = &dest->jmp_list_head;
     TB_FOR_EACH_JMP(dest, tb, n) {
         if (tb == orig && n == n_orig) {