[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/8] curl: avoid recursive locking of BDRVCURLState m
From: |
Jeff Cody |
Subject: |
[Qemu-devel] [PULL 4/8] curl: avoid recursive locking of BDRVCURLState mutex |
Date: |
Tue, 16 May 2017 11:54:16 -0400 |
From: Paolo Bonzini <address@hidden>
The curl driver has a ugly hack where, if it cannot find an empty CURLState,
it just uses aio_poll to wait for one to be empty. This is probably
buggy when used together with dataplane, and the simplest way to fix it
is to use coroutines instead.
A more immediate effect of the bug however is that it can cause a
recursive call to curl_readv_bh_cb and recursively taking the
BDRVCURLState mutex. This causes a deadlock.
The fix is to unlock the mutex around aio_poll, but for cleanliness we
should also take the mutex around all calls to curl_init_state, even if
reaching the unlock/lock pair is impossible. The same is true for
curl_clean_state.
Reported-by: Kun Wei <address@hidden>
Tested-by: Richard W.M. Jones <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
Reviewed-by: Jeff Cody <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Message-id: address@hidden
Cc: address@hidden
Cc: Jeff Cody <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Jeff Cody <address@hidden>
---
block/curl.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/block/curl.c b/block/curl.c
index 18b82bc..c160810 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -282,6 +282,7 @@ read_end:
return size * nmemb;
}
+/* Called with s->mutex held. */
static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
CURLAIOCB *acb)
{
@@ -454,6 +455,7 @@ static void curl_multi_timeout_do(void *arg)
#endif
}
+/* Called with s->mutex held. */
static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
{
CURLState *state = NULL;
@@ -472,7 +474,9 @@ static CURLState *curl_init_state(BlockDriverState *bs,
BDRVCURLState *s)
break;
}
if (!state) {
+ qemu_mutex_unlock(&s->mutex);
aio_poll(bdrv_get_aio_context(bs), true);
+ qemu_mutex_lock(&s->mutex);
}
} while(!state);
@@ -535,6 +539,7 @@ static CURLState *curl_init_state(BlockDriverState *bs,
BDRVCURLState *s)
return state;
}
+/* Called with s->mutex held. */
static void curl_clean_state(CURLState *s)
{
int j;
@@ -566,6 +571,7 @@ static void curl_detach_aio_context(BlockDriverState *bs)
BDRVCURLState *s = bs->opaque;
int i;
+ qemu_mutex_lock(&s->mutex);
for (i = 0; i < CURL_NUM_STATES; i++) {
if (s->states[i].in_use) {
curl_clean_state(&s->states[i]);
@@ -581,6 +587,7 @@ static void curl_detach_aio_context(BlockDriverState *bs)
curl_multi_cleanup(s->multi);
s->multi = NULL;
}
+ qemu_mutex_unlock(&s->mutex);
timer_del(&s->timer);
}
@@ -684,6 +691,7 @@ static int curl_open(BlockDriverState *bs, QDict *options,
int flags,
return -EROFS;
}
+ qemu_mutex_init(&s->mutex);
opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
qemu_opts_absorb_qdict(opts, options, &local_err);
if (local_err) {
@@ -769,7 +777,9 @@ static int curl_open(BlockDriverState *bs, QDict *options,
int flags,
DPRINTF("CURL: Opening %s\n", file);
s->aio_context = bdrv_get_aio_context(bs);
s->url = g_strdup(file);
+ qemu_mutex_lock(&s->mutex);
state = curl_init_state(bs, s);
+ qemu_mutex_unlock(&s->mutex);
if (!state)
goto out_noclean;
@@ -813,11 +823,12 @@ static int curl_open(BlockDriverState *bs, QDict
*options, int flags,
}
DPRINTF("CURL: Size = %zd\n", s->len);
+ qemu_mutex_lock(&s->mutex);
curl_clean_state(state);
+ qemu_mutex_unlock(&s->mutex);
curl_easy_cleanup(state->curl);
state->curl = NULL;
- qemu_mutex_init(&s->mutex);
curl_attach_aio_context(bs, bdrv_get_aio_context(bs));
qemu_opts_del(opts);
@@ -828,6 +839,7 @@ out:
curl_easy_cleanup(state->curl);
state->curl = NULL;
out_noclean:
+ qemu_mutex_destroy(&s->mutex);
g_free(s->cookie);
g_free(s->url);
qemu_opts_del(opts);
--
2.9.3
- [Qemu-devel] [PULL 0/8] Block patches for curl, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 2/8] curl: strengthen assertion in curl_clean_state, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 1/8] block: curl: Allow passing cookies via QCryptoSecret, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 3/8] curl: never invoke callbacks with s->mutex held, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 4/8] curl: avoid recursive locking of BDRVCURLState mutex,
Jeff Cody <=
- [Qemu-devel] [PULL 5/8] curl: split curl_find_state/curl_init_state, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 7/8] curl: convert readv to coroutines, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 6/8] curl: convert CURLAIOCB to byte values, Jeff Cody, 2017/05/16
- [Qemu-devel] [PULL 8/8] curl: do not do aio_poll when waiting for a free CURLState, Jeff Cody, 2017/05/16
- Re: [Qemu-devel] [Qemu-block] [PULL 0/8] Block patches for curl, Stefan Hajnoczi, 2017/05/17