[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 07/18] migration/multifd: fix nullptr access in multifd_send_termi
From: |
Juan Quintela |
Subject: |
[PULL 07/18] migration/multifd: fix nullptr access in multifd_send_terminate_threads |
Date: |
Wed, 29 Jan 2020 12:15:25 +0100 |
From: Zhimin Feng <address@hidden>
If the multifd_send_threads is not created when migration is failed,
multifd_save_cleanup would be called twice. In this senario, the
multifd_send_state is accessed after it has been released, the result
is that the source VM is crashing down.
Here is the coredump stack:
Program received signal SIGSEGV, Segmentation fault.
0x00005629333a78ef in multifd_send_terminate_threads (err=err@entry=0x0) at
migration/ram.c:1012
1012 MultiFDSendParams *p = &multifd_send_state->params[i];
#0 0x00005629333a78ef in multifd_send_terminate_threads
(err=err@entry=0x0) at migration/ram.c:1012
#1 0x00005629333ab8a9 in multifd_save_cleanup () at migration/ram.c:1028
#2 0x00005629333abaea in multifd_new_send_channel_async
(task=0x562935450e70, opaque=<optimized out>) at migration/ram.c:1202
#3 0x000056293373a562 in qio_task_complete
(task=task@entry=0x562935450e70) at io/task.c:196
#4 0x000056293373a6e0 in qio_task_thread_result (opaque=0x562935450e70) at
io/task.c:111
#5 0x00007f475d4d75a7 in g_idle_dispatch () from
/usr/lib64/libglib-2.0.so.0
#6 0x00007f475d4da9a9 in g_main_context_dispatch () from
/usr/lib64/libglib-2.0.so.0
#7 0x0000562933785b33 in glib_pollfds_poll () at util/main-loop.c:219
#8 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
#9 main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:518
#10 0x00005629334c5acf in main_loop () at vl.c:1810
#11 0x000056293334d7bb in main (argc=<optimized out>, argv=<optimized out>,
envp=<optimized out>) at vl.c:4471
If the multifd_send_threads is not created when migration is failed.
In this senario, we don't call multifd_save_cleanup in
multifd_new_send_channel_async.
Signed-off-by: Zhimin Feng <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
---
migration/ram.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/migration/ram.c b/migration/ram.c
index 3fd7fdffcf..82c7edb083 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -1233,7 +1233,15 @@ static void multifd_new_send_channel_async(QIOTask
*task, gpointer opaque)
trace_multifd_new_send_channel_async(p->id);
if (qio_task_propagate_error(task, &local_err)) {
migrate_set_error(migrate_get_current(), local_err);
- multifd_save_cleanup();
+ /* Error happen, we need to tell who pay attention to me */
+ qemu_sem_post(&multifd_send_state->channels_ready);
+ qemu_sem_post(&p->sem_sync);
+ /*
+ * Although multifd_send_thread is not created, but main migration
+ * thread neet to judge whether it is running, so we need to mark
+ * its status.
+ */
+ p->quit = true;
} else {
p->c = QIO_CHANNEL(sioc);
qio_channel_set_delay(p->c, false);
--
2.24.1
- [PULL 06/18] migration: Create migration_is_running(), (continued)
- [PULL 06/18] migration: Create migration_is_running(), Juan Quintela, 2020/01/29
- [PULL 11/18] multifd: multifd_send_sync_main only needs the qemufile, Juan Quintela, 2020/01/29
- [PULL 10/18] multifd: multifd_queue_page only needs the qemufile, Juan Quintela, 2020/01/29
- [PULL 09/18] multifd: multifd_send_pages only needs the qemufile, Juan Quintela, 2020/01/29
- [PULL 15/18] multifd: Make multifd_load_setup() get an Error parameter, Juan Quintela, 2020/01/29
- [PULL 14/18] multifd: Make multifd_save_setup() get an Error parameter, Juan Quintela, 2020/01/29
- [PULL 12/18] multifd: Use qemu_target_page_size(), Juan Quintela, 2020/01/29
- [PULL 13/18] migration: Make checkpatch happy with comments, Juan Quintela, 2020/01/29
- [PULL 17/18] migration: Simplify get_qlist, Juan Quintela, 2020/01/29
- [PULL 18/18] migration/compress: compress QEMUFile is not writable, Juan Quintela, 2020/01/29
- [PULL 07/18] migration/multifd: fix nullptr access in multifd_send_terminate_threads,
Juan Quintela <=
- [PULL 08/18] ram_addr: Split RAMBlock definition, Juan Quintela, 2020/01/29
- [PULL 16/18] multifd: Split multifd code into its own file, Juan Quintela, 2020/01/29
- Re: [PULL 00/18] Pull migration patches, Peter Maydell, 2020/01/30