From patchwork Wed Mar 30 15:14:07 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilya Maximets X-Patchwork-Id: 8698381 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 447049F3D1 for ; Wed, 30 Mar 2016 15:17:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 88912202AE for ; Wed, 30 Mar 2016 15:17:44 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B618E200DE for ; Wed, 30 Mar 2016 15:17:43 +0000 (UTC) Received: from localhost ([::1]:54790 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1alHsN-0002ee-3a for patchwork-qemu-devel@patchwork.kernel.org; Wed, 30 Mar 2016 11:17:43 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1alHpT-00078i-1g for qemu-devel@nongnu.org; Wed, 30 Mar 2016 11:14:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1alHpO-0001hz-0I for qemu-devel@nongnu.org; Wed, 30 Mar 2016 11:14:42 -0400 Received: from mailout4.w1.samsung.com ([210.118.77.14]:60786) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1alHpN-0001hX-Nu for qemu-devel@nongnu.org; Wed, 30 Mar 2016 11:14:37 -0400 Received: from eucpsbgm1.samsung.com (unknown [203.254.199.244]) by mailout4.w1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O4U007GYYCAK440@mailout4.w1.samsung.com> for qemu-devel@nongnu.org; Wed, 30 Mar 2016 16:14:34 +0100 (BST) X-AuditID: cbfec7f4-f796c6d000001486-7d-56fbed5abbaa Received: from eusync1.samsung.com ( [203.254.199.211]) by eucpsbgm1.samsung.com (EUCPMTA) with SMTP id 33.F0.05254.A5DEBF65; Wed, 30 Mar 2016 16:14:34 +0100 (BST) Received: from imaximets.rnd.samsung.ru ([106.109.129.180]) by eusync1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O4U00ACPYBSOO90@eusync1.samsung.com>; Wed, 30 Mar 2016 16:14:34 +0100 (BST) From: Ilya Maximets To: qemu-devel@nongnu.org, "Michael S. Tsirkin" Date: Wed, 30 Mar 2016 18:14:07 +0300 Message-id: <1459350849-31989-3-git-send-email-i.maximets@samsung.com> X-Mailer: git-send-email 2.5.0 In-reply-to: <1459350849-31989-1-git-send-email-i.maximets@samsung.com> References: <1459350849-31989-1-git-send-email-i.maximets@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrPJMWRmVeSWpSXmKPExsVy+t/xy7pRb3+HGZyfzGpxpf0nu8WyS5+Z LP7/esVqcbx3B4vF5NlSDqweT65tZvJ4v+8qm0ffllWMAcxRXDYpqTmZZalF+nYJXBlz95xl LuhSqGh7e4itgbFFqouRk0NCwERi8q+F7BC2mMSFe+vZuhi5OIQEljJK3GzYygjhtDJJfDo+ B6yKTUBH4tTqI4wgtoiAg8SXph9MIDazQInEoV8nwWqEBVwkPv49AVbDIqAq0bVzKxuIzSvg JvF1yXrmLkYOoG1yEgsupIOEOQXcJZZv/M8CYgsBlez6MYV5AiPvAkaGVYyiqaXJBcVJ6bmG esWJucWleel6yfm5mxghwfJlB+PiY1aHGAU4GJV4eDdI/w4TYk0sK67MPcQowcGsJMK78iVQ iDclsbIqtSg/vqg0J7X4EKM0B4uSOO/cXe9DhATSE0tSs1NTC1KLYLJMHJxSDYxVwowP5V6e /nc+ZOJU/oe1s2Ry76huqszdKeZeeLfL+WCGw69JvRxefvkle5IXfV7cusbiWaxY3xRuRmnd nM8KxuLr//BwlUh0NHMIOV6TrY6cepFD0K795ezvzsukrTiZzK+YLfffebjpXXqDp9WlXYbV zMXNsn3/kj8cNLxdI/36L1/cHiWW4oxEQy3mouJEAEUfcl4SAgAA X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 210.118.77.14 Cc: Ilya Maximets , Jason Wang , Dyasly Sergey Subject: [Qemu-devel] [PATCH 2/4] vhost: prevent double stop of vhost_net device. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP There are few control flows in vhost's implementation where vhost_net_stop() may be re entered several times in a row. This leads to triggering of assertion while duble freeing of same resources. For example, if vhost-user socket disconnection occured: [-------------------------------- cut -----------------------------------] [guest]# echo -n '0000:00:01.0' > /sys/bus/pci/drivers/virtio-pci/unbind qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: /qemu/memory.c:1852: memory_region_del_eventfd: Assertion `i != mr->ioeventfd_nb' failed. Child terminated with signal = 0x6 (SIGABRT) GDBserver exiting [-------------------------------- cut -----------------------------------] [host]# gdb Breakpoint 1 in virtio_pci_set_host_notifier_internal() #0 virtio_pci_set_host_notifier_internal #1 vhost_dev_disable_notifiers #2 vhost_net_stop_one #3 vhost_net_stop (dev=dev@entry=0x13a45f8, ncs=0x1ce89f0, <...>) #4 virtio_net_vhost_status #5 virtio_net_set_status #6 qmp_set_link (<...>, up=up@entry=false, <...>) #7 net_vhost_user_event (<...>, event=5) #8 qemu_chr_be_event #9 tcp_chr_disconnect #10 tcp_chr_sync_read #11 qemu_chr_fe_read_all #12 vhost_user_read #13 vhost_user_get_vring_base #14 vhost_virtqueue_stop #15 vhost_dev_stop #16 vhost_net_stop_one #17 vhost_net_stop (dev=dev@entry=0x13a45f8, ncs=0x1ce89f0, <...>) #18 virtio_net_vhost_status #19 virtio_net_set_status #20 virtio_set_status <...> [-------------------------------- cut -----------------------------------] In example above assertion will fail when control will be brought back to function at #17 and it will try to free 'eventfd' that was already freed at call #3. Fix that by disallowing execution of vhost_net_stop() if we're already inside of it. Signed-off-by: Ilya Maximets --- hw/net/vhost_net.c | 8 ++++++++ hw/net/virtio-net.c | 1 + include/hw/virtio/virtio-net.h | 1 + 3 files changed, 10 insertions(+) diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 55d5456..0996e5d 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -335,8 +335,14 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs, BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(dev))); VirtioBusState *vbus = VIRTIO_BUS(qbus); VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus); + VirtIONet *n = VIRTIO_NET(dev); int i, r; + if (n->vhost_stopping_in_progress) { + return; + } + n->vhost_stopping_in_progress = 1; + for (i = 0; i < total_queues; i++) { vhost_net_stop_one(get_vhost_net(ncs[i].peer), dev); put_vhost_net(ncs[i].peer); @@ -348,6 +354,8 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs, fflush(stderr); } assert(r >= 0); + + n->vhost_stopping_in_progress = 0; } void vhost_net_cleanup(struct vhost_net *net) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index e5456ef..9b1539c 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -149,6 +149,7 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t status) } n->vhost_started = 1; + n->vhost_stopping_in_progress = 0; r = vhost_net_start(vdev, n->nic->ncs, queues); if (r < 0) { error_report("unable to start vhost net: %d: " diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h index 0cabdb6..fc07385 100644 --- a/include/hw/virtio/virtio-net.h +++ b/include/hw/virtio/virtio-net.h @@ -74,6 +74,7 @@ typedef struct VirtIONet { uint8_t nouni; uint8_t nobcast; uint8_t vhost_started; + uint8_t vhost_stopping_in_progress; struct { uint32_t in_use; uint32_t first_multi;