From patchwork Tue Jun 13 07:52:09 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Knut Omang X-Patchwork-Id: 9783299 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4B855602DC for ; Tue, 13 Jun 2017 07:53:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3DD1A283C5 for ; Tue, 13 Jun 2017 07:53:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 32053284C6; Tue, 13 Jun 2017 07:53:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E9C1C283C5 for ; Tue, 13 Jun 2017 07:53:34 +0000 (UTC) Received: from localhost ([::1]:41558 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dKgdq-0006d4-10 for patchwork-qemu-devel@patchwork.kernel.org; Tue, 13 Jun 2017 03:53:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50290) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dKgcp-0006bX-Hn for qemu-devel@nongnu.org; Tue, 13 Jun 2017 03:52:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dKgcl-00075K-KI for qemu-devel@nongnu.org; Tue, 13 Jun 2017 03:52:31 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:30120) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dKgcl-00075B-8q for qemu-devel@nongnu.org; Tue, 13 Jun 2017 03:52:27 -0400 Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v5D7qPfL010065 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 13 Jun 2017 07:52:25 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v5D7qP7B021680 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 13 Jun 2017 07:52:25 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v5D7qNmR027981; Tue, 13 Jun 2017 07:52:24 GMT Received: from abi.no.oracle.com (/10.172.144.123) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 13 Jun 2017 00:52:22 -0700 From: Knut Omang To: "Daniel P . Berrange" , Gerd Hoffmann , Paolo Bonzini Date: Tue, 13 Jun 2017 09:52:09 +0200 Message-Id: X-Mailer: git-send-email 2.9.4 In-Reply-To: References: X-Source-IP: aserv0021.oracle.com [141.146.126.233] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] [fuzzy] X-Received-From: 141.146.126.69 Subject: [Qemu-devel] [PATCH v2 1/2] Add test-listen - a stress test for QEMU socket listen X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Knut Omang , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP There's a potential race condition between multiple bind()'s attempting to bind to the same port, which occasionally allows more than one bind to succeed against the same port. When a subsequent listen() call is made with the same socket only one will succeed. The current QEMU code does however not take this situation into account and the listen will cause the code to break out and fail even when there are actually available ports to use. This test exposes two subtests: /socket/listen-serial /socket/listen-compete The "compete" subtest creates a number of threads and have them all trying to bind to the same port with a large enough offset input to allow all threads to get it's own port. The "serial" subtest just does the same, except in series in a single thread. The serial version passes, probably in most versions of QEMU. The parallel version exposes the problem in a relatively reliable way, eg. it fails a majority of times, but not with a 100% rate, occasional passes can be seen. Nevertheless this is quite good given that the bug was tricky to reproduce and has been left undetected for a while. The problem seems to be present in all versions of QEMU. The original failure scenario occurred with VNC port allocation in a traditional Xen based build, in different code but with similar functionality. Reported-by: Bhavesh Davda Signed-off-by: Knut Omang Reviewed-by: Yuval Shaia Reviewed-by: Bhavesh Davda Reviewed-by: Girish Moodalbail --- tests/Makefile.include | 2 +- tests/test-listen.c | 141 ++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 143 insertions(+) create mode 100644 tests/test-listen.c diff --git a/tests/Makefile.include b/tests/Makefile.include index f42f3df..a492285 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -127,6 +127,7 @@ check-unit-y += tests/test-bufferiszero$(EXESUF) gcov-files-check-bufferiszero-y = util/bufferiszero.c check-unit-y += tests/test-uuid$(EXESUF) check-unit-y += tests/ptimer-test$(EXESUF) +#check-unit-y += tests/test-listen$(EXESUF) gcov-files-ptimer-test-y = hw/core/ptimer.c check-unit-y += tests/test-qapi-util$(EXESUF) gcov-files-test-qapi-util-y = qapi/qapi-util.c @@ -760,6 +761,7 @@ tests/test-uuid$(EXESUF): tests/test-uuid.o $(test-util-obj-y) tests/test-arm-mptimer$(EXESUF): tests/test-arm-mptimer.o tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y) tests/numa-test$(EXESUF): tests/numa-test.o +tests/test-listen$(EXESUF): tests/test-listen.o $(test-util-obj-y) tests/migration/stress$(EXESUF): tests/migration/stress.o $(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@") diff --git a/tests/test-listen.c b/tests/test-listen.c new file mode 100644 index 0000000..45fe9a8 --- /dev/null +++ b/tests/test-listen.c @@ -0,0 +1,141 @@ +/* + * Test parallel port listen configuration with + * dynamic port allocation + */ + +#include "qemu/osdep.h" +#include "libqtest.h" +#include "qemu-common.h" +#include "qemu/thread.h" +#include "qemu/sockets.h" +#include "qapi/error.h" + +#define NAME_LEN 1024 +#define PORT_LEN 16 + +struct thr_info { + QemuThread thread; + int to_port; + int got_port; + int eno; + int fd; + const char *errstr; +}; + +static char hostname[NAME_LEN + 1]; +static char port[PORT_LEN + 1]; + +static void *listener_thread(void *arg) +{ + struct thr_info *thr = (struct thr_info *)arg; + SocketAddress addr = { + .type = SOCKET_ADDRESS_TYPE_INET, + .u = { + .inet = { + .host = hostname, + .port = port, + .ipv4 = true, + .has_to = true, + .to = thr->to_port, + }, + }, + }; + Error *err = NULL; + int fd; + + fd = socket_listen(&addr, &err); + if (fd < 0) { + thr->eno = errno; + thr->errstr = error_get_pretty(err); + } else { + struct sockaddr_in a; + socklen_t a_len = sizeof(a); + g_assert_cmpint(getsockname(fd, (struct sockaddr *)&a, &a_len), ==, 0); + thr->got_port = ntohs(a.sin_port); + thr->fd = fd; + } + return arg; +} + + +static void listen_compete_nthr(bool threaded, int nthreads, + int start_port, int max_offset) +{ + int i; + int failed_listens = 0; + size_t alloc_sz = sizeof(struct thr_info) * nthreads; + struct thr_info *thr = g_malloc(alloc_sz); + int used[max_offset + 1]; + memset(used, 0, sizeof(used)); + g_assert_nonnull(thr); + g_assert_cmpint(gethostname(hostname, NAME_LEN), == , 0); + snprintf(port, PORT_LEN, "%d", start_port); + memset(thr, 0, alloc_sz); + + for (i = 0; i < nthreads; i++) { + thr[i].to_port = start_port + max_offset; + if (threaded) { + qemu_thread_create(&thr[i].thread, "listener", + listener_thread, &thr[i], + QEMU_THREAD_JOINABLE); + } else { + listener_thread(&thr[i]); + } + } + + if (threaded) { + for (i = 0; i < nthreads; i++) { + qemu_thread_join(&thr[i].thread); + } + } + for (i = 0; i < nthreads; i++) { + if (thr[i].got_port) { + closesocket(thr[i].fd); + } + } + + for (i = 0; i < nthreads; i++) { + if (thr[i].eno != 0) { + const char *m; + printf("** Failed to assign a port to thread %d (errno = %d)\n", + i, thr[i].eno); + /* This is what we are interested in capturing - + * catch and report details if something unexpected happens: + */ + m = strstr(thr[i].errstr, "Failed to listen on socket"); + if (m != NULL) { + g_assert_cmpstr(thr[i].errstr, ==, + "Failed to listen on socket: Address already in use"); + } + failed_listens++; + } else { + int assigned_port = thr[i].got_port; + g_assert_cmpint(assigned_port, <= , thr[i].to_port); + g_assert_cmpint(used[assigned_port - start_port], == , 0); + } + } + g_assert_cmpint(failed_listens, ==, 0); + free(thr); +} + + +static void listen_compete(void) +{ + listen_compete_nthr(true, 200, 5920, 300); +} + +static void listen_serial(void) +{ + listen_compete_nthr(false, 200, 6300, 300); +} + + +int main(int argc, char **argv) +{ + g_test_init(&argc, &argv, NULL); + + g_test_add_func("/socket/listen-serial", listen_serial); + g_test_add_func("/socket/listen-compete", listen_compete); + + return g_test_run(); +}