From 8bf49fff0dfbb065ad65daa48d2e1a63ad2fd552 Mon Sep 17 00:00:00 2001 From: Zhenzhong Duan Date: Sun, 28 Sep 2025 04:54:30 -0400 Subject: [PATCH] vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit After CPR transfer, if there are more than one VFIO devices, device is not added to hwpt->device_list and its reference to hwpt isn't restored on destination. We still need to call iommufd_cdev_attach_container() to restore it after a matching container is found, or else SIGSEV triggers. Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device") Signed-off-by: Zhenzhong Duan Reviewed-by: Steve Sistare Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-5-zhenzhong.duan@intel.com Signed-off-by: Cédric Le Goater --- hw/vfio/iommufd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c index 63a16d4dc1..24a99efa87 100644 --- a/hw/vfio/iommufd.c +++ b/hw/vfio/iommufd.c @@ -560,10 +560,9 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev, continue; } - if (!cpr_is_incoming()) { + if (!cpr_is_incoming() || + (vbasedev->cpr.ioas_id == container->ioas_id)) { res = iommufd_cdev_attach_container(vbasedev, container, &err); - } else if (vbasedev->cpr.ioas_id == container->ioas_id) { - res = true; } else { continue; } -- 2.47.3