From nobody Fri May 3 05:58:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507895882733916.9993654514967; Fri, 13 Oct 2017 04:58:02 -0700 (PDT) Received: from localhost ([::1]:49719 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2ybB-0007VG-06 for importer@patchew.org; Fri, 13 Oct 2017 07:57:53 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51374) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2yRe-0000ls-B2 for qemu-devel@nongnu.org; Fri, 13 Oct 2017 07:48:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e2yRa-00044I-EA for qemu-devel@nongnu.org; Fri, 13 Oct 2017 07:48:02 -0400 Received: from 11.mo5.mail-out.ovh.net ([46.105.47.167]:53813) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e2yRa-00043j-7b for qemu-devel@nongnu.org; Fri, 13 Oct 2017 07:47:58 -0400 Received: from player773.ha.ovh.net (b9.ovh.net [213.186.33.59]) by mo5.mail-out.ovh.net (Postfix) with ESMTP id AE1391402E3 for ; Fri, 13 Oct 2017 13:47:56 +0200 (CEST) Received: from bahia.lan (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player773.ha.ovh.net (Postfix) with ESMTPA id 10315600075; Fri, 13 Oct 2017 13:47:51 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Fri, 13 Oct 2017 13:47:51 +0200 Message-ID: <150789527176.5487.14861721766357709655.stgit@bahia.lan> User-Agent: StGit/0.17.1-46-g6855-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 12100046300532152686 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedttddrtdeigdegiecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 46.105.47.167 Subject: [Qemu-devel] [PATCH] monitor: fix dangling CPU pointer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Igor Mammedov , qemu-ppc@nongnu.org, Markus Armbruster , "Dr. David Alan Gilbert" Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 If a CPU selected with the "cpu" command is hot-unplugged then "info cpus" causes QEMU to exit: (qemu) device_del cpu1 (qemu) info cpus qemu:qemu_cpu_kick_thread: No such process This happens because "cpu" stores the pointer to the selected CPU into the monitor structure. When the CPU is hot-unplugged, we end up with a dangling pointer. The "info cpus" command then does: hmp_info_cpus() monitor_get_cpu_index() mon_get_cpu() cpu_synchronize_state() <--- called with dangling pointer This could cause a QEMU crash as well. This patch switches the monitor to store the QOM path instead of a pointer to the current CPU. The path is then resolved when needed. If the resolution fails, we assume that the CPU was removed and the path is resetted to the default (ie, path of first_cpu). Note that the resolution should really return a CPU object, otherwise we have a bug. This is achieved by relying on object_resolve_path() and CPU() instead of calling object_resolve_path_type(path, TYPE_CPU). Suggested-by: Igor Mammedov Signed-off-by: Greg Kurz Reported-by: Satheesh Rajendran --- monitor.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/monitor.c b/monitor.c index fe0d1bdbb461..8489b2ad99c0 100644 --- a/monitor.c +++ b/monitor.c @@ -200,7 +200,7 @@ struct Monitor { =20 ReadLineState *rs; MonitorQMP qmp; - CPUState *mon_cpu; + gchar *mon_cpu_path; BlockCompletionFunc *password_completion_cb; void *password_opaque; mon_cmd_t *cmd_table; @@ -579,6 +579,7 @@ static void monitor_data_init(Monitor *mon) =20 static void monitor_data_destroy(Monitor *mon) { + g_free(mon->mon_cpu_path); qemu_chr_fe_deinit(&mon->chr, false); if (monitor_is_qmp(mon)) { json_message_parser_destroy(&mon->qmp.parser); @@ -1047,20 +1048,34 @@ int monitor_set_cpu(int cpu_index) if (cpu =3D=3D NULL) { return -1; } - cur_mon->mon_cpu =3D cpu; + g_free(cur_mon->mon_cpu_path); + cur_mon->mon_cpu_path =3D object_get_canonical_path(OBJECT(cpu)); return 0; } =20 CPUState *mon_get_cpu(void) { - if (!cur_mon->mon_cpu) { + CPUState *cpu; + + if (cur_mon->mon_cpu_path) { + Object *obj =3D object_resolve_path(cur_mon->mon_cpu_path, NULL); + + if (!obj) { + g_free(cur_mon->mon_cpu_path); + cur_mon->mon_cpu_path =3D NULL; + } else { + cpu =3D CPU(obj); + } + } + if (!cur_mon->mon_cpu_path) { if (!first_cpu) { return NULL; } monitor_set_cpu(first_cpu->cpu_index); + cpu =3D first_cpu; } - cpu_synchronize_state(cur_mon->mon_cpu); - return cur_mon->mon_cpu; + cpu_synchronize_state(cpu); + return cpu; } =20 CPUArchState *mon_get_cpu_env(void)