|
 |
902636 |
From 7f664fe26ff67f8131faa7a81a388b8a5b51403f Mon Sep 17 00:00:00 2001
|
|
|
902636 |
From: Juan Quintela <quintela@redhat.com>
|
|
|
902636 |
Date: Tue, 3 Mar 2020 14:51:36 +0000
|
|
|
902636 |
Subject: [PATCH 04/18] migration/multifd: fix nullptr access in terminating
|
|
|
902636 |
multifd threads
|
|
|
902636 |
|
|
|
902636 |
RH-Author: Juan Quintela <quintela@redhat.com>
|
|
|
902636 |
Message-id: <20200303145143.149290-4-quintela@redhat.com>
|
|
|
902636 |
Patchwork-id: 94110
|
|
|
902636 |
O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 03/10] migration/multifd: fix nullptr access in terminating multifd threads
|
|
|
902636 |
Bugzilla: 1738451
|
|
|
902636 |
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
|
|
|
902636 |
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
|
902636 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
902636 |
|
|
|
902636 |
From: Jiahui Cen <cenjiahui@huawei.com>
|
|
|
902636 |
|
|
|
902636 |
One multifd channel will shutdown all the other multifd's IOChannel when it
|
|
|
902636 |
fails to receive an IOChannel. In this senario, if some multifds had not
|
|
|
902636 |
received its IOChannel yet, it would try to shutdown its IOChannel which could
|
|
|
902636 |
cause nullptr access at qio_channel_shutdown.
|
|
|
902636 |
|
|
|
902636 |
Here is the coredump stack:
|
|
|
902636 |
#0 object_get_class (obj=obj@entry=0x0) at qom/object.c:908
|
|
|
902636 |
#1 0x00005563fdbb8f4a in qio_channel_shutdown (ioc=0x0, how=QIO_CHANNEL_SHUTDOWN_BOTH, errp=0x0) at io/channel.c:355
|
|
|
902636 |
#2 0x00005563fd7b4c5f in multifd_recv_terminate_threads (err=<optimized out>) at migration/ram.c:1280
|
|
|
902636 |
#3 0x00005563fd7bc019 in multifd_recv_new_channel (ioc=ioc@entry=0x556400255610, errp=errp@entry=0x7ffec07dce00) at migration/ram.c:1478
|
|
|
902636 |
#4 0x00005563fda82177 in migration_ioc_process_incoming (ioc=ioc@entry=0x556400255610, errp=errp@entry=0x7ffec07dce30) at migration/migration.c:605
|
|
|
902636 |
#5 0x00005563fda8567d in migration_channel_process_incoming (ioc=0x556400255610) at migration/channel.c:44
|
|
|
902636 |
#6 0x00005563fda83ee0 in socket_accept_incoming_migration (listener=0x5563fff6b920, cioc=0x556400255610, opaque=<optimized out>) at migration/socket.c:166
|
|
|
902636 |
#7 0x00005563fdbc25cd in qio_net_listener_channel_func (ioc=<optimized out>, condition=<optimized out>, opaque=<optimized out>) at io/net-listener.c:54
|
|
|
902636 |
#8 0x00007f895b6fe9a9 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
|
|
|
902636 |
#9 0x00005563fdc18136 in glib_pollfds_poll () at util/main-loop.c:218
|
|
|
902636 |
#10 0x00005563fdc181b5 in os_host_main_loop_wait (timeout=1000000000) at util/main-loop.c:241
|
|
|
902636 |
#11 0x00005563fdc183a2 in main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:517
|
|
|
902636 |
#12 0x00005563fd8edb37 in main_loop () at vl.c:1791
|
|
|
902636 |
#13 0x00005563fd74fd45 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4473
|
|
|
902636 |
|
|
|
902636 |
To fix it up, let's check p->c before calling qio_channel_shutdown.
|
|
|
902636 |
|
|
|
902636 |
Signed-off-by: Jiahui Cen <cenjiahui@huawei.com>
|
|
|
902636 |
Signed-off-by: Ying Fang <fangying1@huawei.com>
|
|
|
902636 |
Reviewed-by: Juan Quintela <quintela@redhat.com>
|
|
|
902636 |
Signed-off-by: Juan Quintela <quintela@redhat.com>
|
|
|
902636 |
(cherry picked from commit f76e32eb05041ab001184ab16afb56524adccd0c)
|
|
|
902636 |
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
|
902636 |
---
|
|
|
902636 |
migration/ram.c | 4 +++-
|
|
|
902636 |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
902636 |
|
|
|
902636 |
diff --git a/migration/ram.c b/migration/ram.c
|
|
|
902636 |
index 8c783b3..860f781 100644
|
|
|
902636 |
--- a/migration/ram.c
|
|
|
902636 |
+++ b/migration/ram.c
|
|
|
902636 |
@@ -1307,7 +1307,9 @@ static void multifd_recv_terminate_threads(Error *err)
|
|
|
902636 |
- normal quit, i.e. everything went fine, just finished
|
|
|
902636 |
- error quit: We close the channels so the channel threads
|
|
|
902636 |
finish the qio_channel_read_all_eof() */
|
|
|
902636 |
- qio_channel_shutdown(p->c, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
|
|
|
902636 |
+ if (p->c) {
|
|
|
902636 |
+ qio_channel_shutdown(p->c, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
|
|
|
902636 |
+ }
|
|
|
902636 |
qemu_mutex_unlock(&p->mutex);
|
|
|
902636 |
}
|
|
|
902636 |
}
|
|
|
902636 |
--
|
|
|
902636 |
1.8.3.1
|
|
|
902636 |
|