| Message ID | 20181010120841.13214-6-fli@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | qemu_thread_create: propagate errors to callers to check | expand |
Fei Li <fli@suse.com> writes: > When multifd is used during migration, if there is an error before > the destination receives all new channels, the destination does not > exit but keeps waiting in our current code. However, a segmentaion segmentation > fault will occur in the source when multifd_save_cleanup() is called > again as the multifd_send_state has been freed earlier in the first > error handling. This can happen when migrate_fd_connect() fails and > multifd_fd_cleanup() is called, and then multifd_new_send_channel_ > async() fails and multifd_save_cleanup() is called again. > > If the QIOChannel *c of multifd_recv_state->params[i] (p->c) is not > initialized, there is no need to close the channel. Or else a > segmentation fault will occur in multifd_recv_terminate_threads() > when multifd_recv_initial_packet() fails. > > Signed-off-by: Fei Li <fli@suse.com> > --- > migration/ram.c | 22 ++++++++++++++++------ > 1 file changed, 16 insertions(+), 6 deletions(-) > > diff --git a/migration/ram.c b/migration/ram.c > index bc38d98cc3..41dc94c059 100644 > --- a/migration/ram.c > +++ b/migration/ram.c > @@ -907,6 +907,11 @@ static void multifd_send_terminate_threads(Error *err) > } > } > > + /* in case multifd_send_state has been freed earlier */ > + if (!multifd_send_state) { > + return; > + } > + > for (i = 0; i < migrate_multifd_channels(); i++) { > MultiFDSendParams *p = &multifd_send_state->params[i]; > > @@ -922,7 +927,7 @@ int multifd_save_cleanup(Error **errp) > int i; > int ret = 0; > > - if (!migrate_use_multifd()) { > + if (!migrate_use_multifd() || !multifd_send_state) { > return 0; > } > multifd_send_terminate_threads(NULL); > @@ -1131,7 +1136,7 @@ struct { > uint64_t packet_num; > } *multifd_recv_state; > > -static void multifd_recv_terminate_threads(Error *err) > +static void multifd_recv_terminate_threads(Error *err, bool channel) > { > int i; > > @@ -1145,6 +1150,11 @@ static void multifd_recv_terminate_threads(Error *err) > } > } > > + /* in case p->c is not initialized */ > + if (!channel) { > + return; > + } > + > for (i = 0; i < migrate_multifd_channels(); i++) { > MultiFDRecvParams *p = &multifd_recv_state->params[i]; > The function does one thing always, another thing only when its argument @channel is true, and ... > @@ -1166,7 +1176,7 @@ int multifd_load_cleanup(Error **errp) > if (!migrate_use_multifd()) { > return 0; > } > - multifd_recv_terminate_threads(NULL); > + multifd_recv_terminate_threads(NULL, true); > for (i = 0; i < migrate_multifd_channels(); i++) { > MultiFDRecvParams *p = &multifd_recv_state->params[i]; > > @@ -1269,7 +1279,7 @@ static void *multifd_recv_thread(void *opaque) > } > > if (local_err) { > - multifd_recv_terminate_threads(local_err); > + multifd_recv_terminate_threads(local_err, true); > } > qemu_mutex_lock(&p->mutex); > p->running = false; > @@ -1331,7 +1341,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) > > id = multifd_recv_initial_packet(ioc, &local_err); > if (id < 0) { > - multifd_recv_terminate_threads(local_err); > + multifd_recv_terminate_threads(local_err, false); > return false; > } > > @@ -1339,7 +1349,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) > if (p->c != NULL) { > error_setg(&local_err, "multifd: received id '%d' already setup'", > id); > - multifd_recv_terminate_threads(local_err); > + multifd_recv_terminate_threads(local_err, true); > return false; > } > p->c = ioc; ... all callers pass literal true or false. Should we split the function into its two parts, and call the second half only in the places where its needed? Matter of taste, I guess. The maintainers may have an opinion.
diff --git a/migration/ram.c b/migration/ram.c index bc38d98cc3..41dc94c059 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -907,6 +907,11 @@ static void multifd_send_terminate_threads(Error *err) } } + /* in case multifd_send_state has been freed earlier */ + if (!multifd_send_state) { + return; + } + for (i = 0; i < migrate_multifd_channels(); i++) { MultiFDSendParams *p = &multifd_send_state->params[i]; @@ -922,7 +927,7 @@ int multifd_save_cleanup(Error **errp) int i; int ret = 0; - if (!migrate_use_multifd()) { + if (!migrate_use_multifd() || !multifd_send_state) { return 0; } multifd_send_terminate_threads(NULL); @@ -1131,7 +1136,7 @@ struct { uint64_t packet_num; } *multifd_recv_state; -static void multifd_recv_terminate_threads(Error *err) +static void multifd_recv_terminate_threads(Error *err, bool channel) { int i; @@ -1145,6 +1150,11 @@ static void multifd_recv_terminate_threads(Error *err) } } + /* in case p->c is not initialized */ + if (!channel) { + return; + } + for (i = 0; i < migrate_multifd_channels(); i++) { MultiFDRecvParams *p = &multifd_recv_state->params[i]; @@ -1166,7 +1176,7 @@ int multifd_load_cleanup(Error **errp) if (!migrate_use_multifd()) { return 0; } - multifd_recv_terminate_threads(NULL); + multifd_recv_terminate_threads(NULL, true); for (i = 0; i < migrate_multifd_channels(); i++) { MultiFDRecvParams *p = &multifd_recv_state->params[i]; @@ -1269,7 +1279,7 @@ static void *multifd_recv_thread(void *opaque) } if (local_err) { - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, true); } qemu_mutex_lock(&p->mutex); p->running = false; @@ -1331,7 +1341,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) id = multifd_recv_initial_packet(ioc, &local_err); if (id < 0) { - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, false); return false; } @@ -1339,7 +1349,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) if (p->c != NULL) { error_setg(&local_err, "multifd: received id '%d' already setup'", id); - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, true); return false; } p->c = ioc;
When multifd is used during migration, if there is an error before the destination receives all new channels, the destination does not exit but keeps waiting in our current code. However, a segmentaion fault will occur in the source when multifd_save_cleanup() is called again as the multifd_send_state has been freed earlier in the first error handling. This can happen when migrate_fd_connect() fails and multifd_fd_cleanup() is called, and then multifd_new_send_channel_ async() fails and multifd_save_cleanup() is called again. If the QIOChannel *c of multifd_recv_state->params[i] (p->c) is not initialized, there is no need to close the channel. Or else a segmentation fault will occur in multifd_recv_terminate_threads() when multifd_recv_initial_packet() fails. Signed-off-by: Fei Li <fli@suse.com> --- migration/ram.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)