26ba25
From 699be60852400ad3459992a02c8477c08944ad09 Mon Sep 17 00:00:00 2001
26ba25
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
26ba25
Date: Wed, 1 Aug 2018 13:55:18 +0100
26ba25
Subject: [PATCH] Migration+TLS: Fix crash due to double cleanup
26ba25
MIME-Version: 1.0
26ba25
Content-Type: text/plain; charset=UTF-8
26ba25
Content-Transfer-Encoding: 8bit
26ba25
26ba25
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
26ba25
Message-id: <20180801135522.11658-15-dgilbert@redhat.com>
26ba25
Patchwork-id: 81569
26ba25
O-Subject: [qemu-kvm RHEL8/virt212 PATCH 14/18] Migration+TLS: Fix crash due to double cleanup
26ba25
Bugzilla: 1594384
26ba25
RH-Acked-by: Peter Xu <peterx@redhat.com>
26ba25
RH-Acked-by: John Snow <jsnow@redhat.com>
26ba25
RH-Acked-by: Juan Quintela <quintela@redhat.com>
26ba25
26ba25
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
26ba25
26ba25
During a TLS connect we see:
26ba25
  migration_channel_connect calls
26ba25
  migration_tls_channel_connect
26ba25
  (calls after TLS setup)
26ba25
  migration_channel_connect
26ba25
26ba25
My previous error handling fix made migration_channel_connect
26ba25
call migrate_fd_connect in all cases; unfortunately the above
26ba25
means it gets called twice and crashes doing double cleanup.
26ba25
26ba25
Fixes: 688a3dcba98
26ba25
26ba25
Reported-by: Peter Krempa <pkrempa@redhat.com>
26ba25
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
26ba25
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
26ba25
Message-Id: <20180430185943.35714-1-dgilbert@redhat.com>
26ba25
Signed-off-by: Juan Quintela <quintela@redhat.com>
26ba25
(cherry picked from commit 8b7bf2badac25c0a52aff1b181ad75fdb304dd0c)
26ba25
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
26ba25
---
26ba25
 migration/channel.c | 9 +++++++++
26ba25
 1 file changed, 9 insertions(+)
26ba25
26ba25
diff --git a/migration/channel.c b/migration/channel.c
26ba25
index c5eaf0f..7a32b5a 100644
26ba25
--- a/migration/channel.c
26ba25
+++ b/migration/channel.c
26ba25
@@ -71,6 +71,15 @@ void migration_channel_connect(MigrationState *s,
26ba25
             !object_dynamic_cast(OBJECT(ioc),
26ba25
                                  TYPE_QIO_CHANNEL_TLS)) {
26ba25
             migration_tls_channel_connect(s, ioc, hostname, &error);
26ba25
+
26ba25
+            if (!error) {
26ba25
+                /* tls_channel_connect will call back to this
26ba25
+                 * function after the TLS handshake,
26ba25
+                 * so we mustn't call migrate_fd_connect until then
26ba25
+                 */
26ba25
+
26ba25
+                return;
26ba25
+            }
26ba25
         } else {
26ba25
             QEMUFile *f = qemu_fopen_channel_output(ioc);
26ba25
 
26ba25
-- 
26ba25
1.8.3.1
26ba25