virtio_iommu_map() does not check that virt_end >= virt_start (virt_end is inclusive per the virtio-iommu protocol). An inverted range is inserted into domain->mappings. interval_cmp() assumes non-inverted intervals; for an inverted key, cmp(key, key) is not 0, violating the GTree comparator contract. A subsequent covering UNMAP repeats the loop in virtio_iommu_unmap(): the covering lookup finds the mapping, but g_tree_remove() cannot remove the inverted key, so the loop does not terminate. The loop runs while s->mutex is held by virtio_iommu_handle_command(). The command virtqueue handler never returns, and paths that require the same mutex cannot make progress. If an endpoint has IOMMU_NOTIFIER_MAP enabled, the MAP path can also enter a non-terminating walk in virtio_iommu_notify_map_unmap() because (virt_end - virt_start) wraps and the while (virt_start != virt_end + 1) condition does not terminate. Tested version: QEMU 11.0.50 (v11.0.0-1379) commit 81cc5f39aa3042e9c0b2ea772b42a2c8b1488e76 x86_64 ASAN build: build-x86_64-asan-klaus/qemu-system-x86_64 Root cause (code): hw/virtio/virtio-iommu.c: interval_cmp(): if (inta->high < intb->low) return -1; if (intb->high < inta->low) return 1; return 0; // for inverted (high < low), cmp(a,a) returns -1, not 0 virtio_iommu_map(): interval->low = virt_start; interval->high = virt_end; // no virt_end >= virt_start check g_tree_insert(domain->mappings, interval, mapping); virtio_iommu_unmap(): while (g_tree_lookup_extended(...)) { ... g_tree_remove(...); // may not remove inverted key } // → infinite loop virtio_iommu_notify_map_unmap(): delta = virt_end - virt_start; // wraps if inverted while (virt_start != virt_end + 1) { ... } Impact: The UNMAP request and command virtqueue handler do not complete. The affected virtio-iommu command processing makes no progress until QEMU is terminated. Locking impact: virtio_iommu_handle_command() acquires s->mutex before dispatching MAP and UNMAP requests. If UNMAP enters the non-terminating loop, this mutex is never released. Other command or translation paths that need s->mutex then block behind it. The mutex is not needed to trigger the BUG; it only increases the scope of the resulting stall. qtest source: #include "qemu/osdep.h" #include "libqtest-single.h" #include "qemu/module.h" #include "libqos/qgraph.h" #include "libqos/virtio-iommu.h" #include "hw/virtio/virtio-iommu.h" #define QVIRTIO_IOMMU_TIMEOUT_US (30 * 1000 * 1000) static QGuestAllocator *alloc; static int read_tail_status(struct virtio_iommu_req_tail *buffer) { int i; for (i = 0; i < 3; i++) { g_assert_cmpint(buffer->reserved[i], ==, 0); } return buffer->status; } static int send_attach(QTestState *qts, QVirtioIOMMU *v_iommu, uint32_t domain, uint32_t ep) { QVirtioDevice *dev = v_iommu->vdev; QVirtQueue *vq = v_iommu->vq; uint64_t ro_addr, wr_addr; uint32_t free_head; struct virtio_iommu_req_attach req = {}; size_t ro_size = sizeof(req) - sizeof(struct virtio_iommu_req_tail); size_t wr_size = sizeof(struct virtio_iommu_req_tail); struct virtio_iommu_req_tail buffer; int ret; req.head.type = VIRTIO_IOMMU_T_ATTACH; req.domain = cpu_to_le32(domain); req.endpoint = cpu_to_le32(ep); ro_addr = guest_alloc(alloc, ro_size); wr_addr = guest_alloc(alloc, wr_size); qtest_memwrite(qts, ro_addr, &req, ro_size); free_head = qvirtqueue_add(qts, vq, ro_addr, ro_size, false, true); qvirtqueue_add(qts, vq, wr_addr, wr_size, true, false); qvirtqueue_kick(qts, dev, vq, free_head); qvirtio_wait_used_elem(qts, dev, vq, free_head, NULL, QVIRTIO_IOMMU_TIMEOUT_US); qtest_memread(qts, wr_addr, &buffer, wr_size); ret = read_tail_status(&buffer); guest_free(alloc, ro_addr); guest_free(alloc, wr_addr); return ret; } static int send_map(QTestState *qts, QVirtioIOMMU *v_iommu, uint32_t domain, uint64_t virt_start, uint64_t virt_end, uint64_t phys_start, uint32_t flags) { QVirtioDevice *dev = v_iommu->vdev; QVirtQueue *vq = v_iommu->vq; uint64_t ro_addr, wr_addr; uint32_t free_head; struct virtio_iommu_req_map req = {}; size_t ro_size = sizeof(req) - sizeof(struct virtio_iommu_req_tail); size_t wr_size = sizeof(struct virtio_iommu_req_tail); struct virtio_iommu_req_tail buffer; int ret; req.head.type = VIRTIO_IOMMU_T_MAP; req.domain = cpu_to_le32(domain); req.virt_start = cpu_to_le64(virt_start); req.virt_end = cpu_to_le64(virt_end); req.phys_start = cpu_to_le64(phys_start); req.flags = cpu_to_le32(flags); ro_addr = guest_alloc(alloc, ro_size); wr_addr = guest_alloc(alloc, wr_size); qtest_memwrite(qts, ro_addr, &req, ro_size); free_head = qvirtqueue_add(qts, vq, ro_addr, ro_size, false, true); qvirtqueue_add(qts, vq, wr_addr, wr_size, true, false); qvirtqueue_kick(qts, dev, vq, free_head); qvirtio_wait_used_elem(qts, dev, vq, free_head, NULL, QVIRTIO_IOMMU_TIMEOUT_US); qtest_memread(qts, wr_addr, &buffer, wr_size); ret = read_tail_status(&buffer); guest_free(alloc, ro_addr); guest_free(alloc, wr_addr); return ret; } static int send_unmap(QTestState *qts, QVirtioIOMMU *v_iommu, uint32_t domain, uint64_t virt_start, uint64_t virt_end) { QVirtioDevice *dev = v_iommu->vdev; QVirtQueue *vq = v_iommu->vq; uint64_t ro_addr, wr_addr; uint32_t free_head; struct virtio_iommu_req_unmap req = {}; size_t ro_size = sizeof(req) - sizeof(struct virtio_iommu_req_tail); size_t wr_size = sizeof(struct virtio_iommu_req_tail); struct virtio_iommu_req_tail buffer; int ret; req.head.type = VIRTIO_IOMMU_T_UNMAP; req.domain = cpu_to_le32(domain); req.virt_start = cpu_to_le64(virt_start); req.virt_end = cpu_to_le64(virt_end); ro_addr = guest_alloc(alloc, ro_size); wr_addr = guest_alloc(alloc, wr_size); qtest_memwrite(qts, ro_addr, &req, ro_size); free_head = qvirtqueue_add(qts, vq, ro_addr, ro_size, false, true); qvirtqueue_add(qts, vq, wr_addr, wr_size, true, false); qvirtqueue_kick(qts, dev, vq, free_head); qvirtio_wait_used_elem(qts, dev, vq, free_head, NULL, QVIRTIO_IOMMU_TIMEOUT_US); qtest_memread(qts, wr_addr, &buffer, wr_size); ret = read_tail_status(&buffer); guest_free(alloc, ro_addr); guest_free(alloc, wr_addr); return ret; } static void test_inverted_map_hang(void *obj, void *data, QGuestAllocator *t_alloc) { QVirtioIOMMU *v_iommu = obj; QTestState *qts = global_qtest; int ret; alloc = t_alloc; ret = send_attach(qts, v_iommu, 1, 0); g_assert_cmpint(ret, ==, 0); ret = send_map(qts, v_iommu, 1, 0x20000, 0x10000, 0xb1000, VIRTIO_IOMMU_MAP_F_READ | VIRTIO_IOMMU_MAP_F_WRITE); g_assert_cmpint(ret, ==, 0); ret = send_unmap(qts, v_iommu, 1, 0, UINT64_MAX); (void)ret; } static void register_virtio_iommu_inverted_hang(void) { qos_add_test("inverted_map_hang", "virtio-iommu", test_inverted_map_hang, NULL); } libqos_init(register_virtio_iommu_inverted_hang);