[PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP

[Fiona Ebner <f.ebner@proxmox.com>]

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v3:
* Use 11.1.3 as a base. Almost all changes from this patch in its v2
  version are now already included there.

 ...ore-backend-features-in-x-query-virt.patch | 41 ++++++++++
 ...dle-missing-vhost-user-protocol-feat.patch | 74 +++++++++++++++++++
 debian/patches/series                         |  2 +
 3 files changed, 117 insertions(+)
 create mode 100644 debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
 create mode 100644 debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch

diff --git a/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
new file mode 100644
index 0000000000..cbee94c9fc
--- /dev/null
+++ b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Date: Wed, 23 Sep 2026 00:32:09 +0300
+Subject: [PATCH] qapi/virtio: Restore backend features in
+ x-query-virtio-status
+
+Commit 1ee0bc0c9bf0 removed vhost_dev.backend_features and its
+representation in VhostStatus. It also removed the assignment to
+VirtioStatus.backend_features, although both that field and its source,
+VirtIODevice.backend_features_ex, still exist.
+
+The resulting NULL pointer causes HMP info virtio-status and QMP
+x-query-virtio-status to crash. This affects virtio devices even without
+an active vhost backend.
+
+Restore the assignment from VirtIODevice.backend_features_ex and
+enable corresponding test, which becomes fixed.
+
+Fixes: 1ee0bc0c9bf0 ("vhost: drop backend_features field")
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-3-vsementsov@yandex-team.ru
+(pick from qemu-devel)
+[FE: drop test that would require multiple prerequisite cherry-picks]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/virtio/virtio-qmp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
+index 57cc03828c..36907180f7 100644
+--- a/hw/virtio/virtio-qmp.c
++++ b/hw/virtio/virtio-qmp.c
+@@ -713,6 +713,8 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp)
+                                                  vdev->guest_features_ex);
+     status->host_features = qmp_decode_features(vdev->device_id,
+                                                 vdev->host_features_ex);
++    status->backend_features = qmp_decode_features(vdev->device_id,
++                                                   vdev->backend_features_ex);
+ 
+     switch (vdev->device_endian) {
+     case VIRTIO_DEVICE_ENDIAN_LITTLE:
diff --git a/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
new file mode 100644
index 0000000000..ce3c49cce0
--- /dev/null
+++ b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
@@ -0,0 +1,74 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Date: Wed, 23 Sep 2026 00:32:10 +0300
+Subject: [PATCH] qapi/monitor: Handle missing vhost-user protocol features
+
+Commit f9a8f5812607 moved protocol_features to the vhost-user backend.
+As a result, VhostStatus.protocol_features is only populated for
+vhost-user devices.
+
+For an active kernel vhost device, HMP info virtio-status and QMP
+x-query-virtio-status crashes now because of unset protocol-features.
+
+Make protocol-features optional in VhostStatus and skip dumping a
+missing object in HMP.
+
+For QMP we can change the x-query-virtio-status command semantics
+because it is unstable.
+
+Enable corresponding test, it works now.
+
+Fixes: f9a8f5812607 ("vhost: move protocol_features to vhost_user")
+Co-authored-by: Nikolay Kuratov <kniv@yandex-team.ru>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-4-vsementsov@yandex-team.ru
+(pick from qemu-devel)
+[FE: backport adapting to missing monitor_hmp_printf refactor
+     drop test would require multiple prerequisite cherry-picks]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/virtio/virtio-hmp-cmds.c | 6 ++++--
+ qapi/virtio.json            | 5 +++--
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c
+index a91bb7dbed..c4adb6eb7b 100644
+--- a/hw/virtio/virtio-hmp-cmds.c
++++ b/hw/virtio/virtio-hmp-cmds.c
+@@ -176,8 +176,10 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict)
+         hmp_virtio_dump_features(mon, s->vhost_dev->features);
+         monitor_printf(mon, "    Acked features:\n");
+         hmp_virtio_dump_features(mon, s->vhost_dev->acked_features);
+-        monitor_printf(mon, "    Protocol features:\n");
+-        hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features);
++        if (s->vhost_dev->protocol_features) {
++            monitor_printf(mon, "    Protocol features:\n");
++            hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features);
++        }
+     }
+ 
+     qapi_free_VirtioStatus(s);
+diff --git a/qapi/virtio.json b/qapi/virtio.json
+index 1fc4e38a44..f8e699a0e4 100644
+--- a/qapi/virtio.json
++++ b/qapi/virtio.json
+@@ -85,7 +85,8 @@
+ #
+ # @acked-features: vhost_dev acked_features
+ #
+-# @protocol-features: vhost_dev protocol_features
++# @protocol-features: vhost-user protocol features.  Present only for
++#     vhost-user devices.
+ #
+ # @max-queues: vhost_dev max_queues
+ #
+@@ -104,7 +105,7 @@
+             'vq-index': 'int',
+             'features': 'VirtioDeviceFeatures',
+             'acked-features': 'VirtioDeviceFeatures',
+-            'protocol-features': 'VhostDeviceProtocols',
++            '*protocol-features': 'VhostDeviceProtocols',
+             'max-queues': 'uint64',
+             'backend-cap': 'uint64',
+             'log-enabled': 'bool',
diff --git a/debian/patches/series b/debian/patches/series
index 3140ed6230..1828cca017 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,6 +2,8 @@ extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
 extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
 extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
 extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
+extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
+extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
-- 
2.47.3