From nobody Thu May 2 04:33:36 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 63.128.21.124 as permitted sender) client-ip=63.128.21.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 63.128.21.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1614166259; cv=none; d=zohomail.com; s=zohoarc; b=TD2tGYGvnhctaBHHxEfmhykobQt22vPprCUgdZE/H2pHWpasI1r4zmJRBL57t3vkRQ+3IcTtNSyjBvwlD+sFuKu5BYYMlw1s7v5Euqn2/G//vM6JVb9ndIZDHkWWb/E3Bj1itHv6fTRPiI/Jr8lYNSiFVU48V6GgXI7E65JnIrE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1614166259; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=bYdWeOJZDo42xWY8rSH3mqqF/3jqNazXkMwFk7PzS1s=; b=T4K7jds6/1y/zM/0s18FsKvgmPyJZrGxfKBs+Ix/fzc2ibJWmCvUEVPjrquJ5wEVkZnhZSjomccBcxPKy7yUM7GTbs5BJrMPdtxowglaI/Wmm1D3cxKIzWj8THLLOtFecObUufyPGGV1U2eV7iXfwRML/Nacs2PSVsSFfU7LMIc= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 63.128.21.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [63.128.21.124]) by mx.zohomail.com with SMTPS id 1614166259066471.0129718150637; Wed, 24 Feb 2021 03:30:59 -0800 (PST) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-604-ojB6lF4dMWmeh5Rb9gXIOg-1; Wed, 24 Feb 2021 06:30:47 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0CDCD1020C21; Wed, 24 Feb 2021 11:30:41 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CB9935D74A; Wed, 24 Feb 2021 11:30:40 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 8737418095CB; Wed, 24 Feb 2021 11:30:39 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 11OBUbk9026479 for ; Wed, 24 Feb 2021 06:30:37 -0500 Received: by smtp.corp.redhat.com (Postfix) id 23FDC2026D48; Wed, 24 Feb 2021 11:30:37 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1D5C1202A429 for ; Wed, 24 Feb 2021 11:30:34 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 17AED858294 for ; Wed, 24 Feb 2021 11:30:34 +0000 (UTC) Received: from szxga06-in.huawei.com (szxga06-in.huawei.com [45.249.212.32]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-410-H0bxgVPuM5yyNpjEV2ckFg-1; Wed, 24 Feb 2021 06:30:29 -0500 Received: from DGGEMS404-HUB.china.huawei.com (unknown [172.30.72.58]) by szxga06-in.huawei.com (SkyGuard) with ESMTP id 4DltwY45wxzjQVd; Wed, 24 Feb 2021 19:29:01 +0800 (CST) Received: from localhost.localdomain (10.175.104.175) by DGGEMS404-HUB.china.huawei.com (10.3.19.204) with Microsoft SMTP Server id 14.3.498.0; Wed, 24 Feb 2021 19:30:08 +0800 X-MC-Unique: ojB6lF4dMWmeh5Rb9gXIOg-1 X-MC-Unique: H0bxgVPuM5yyNpjEV2ckFg-1 From: Peng Liang To: Subject: [PATCH v2] qemu: Add missing lock in qemuProcessHandleMonitorEOF Date: Wed, 24 Feb 2021 19:28:23 +0800 Message-ID: <20210224112823.612665-1-liangpeng10@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.104.175] X-CFilter-Loop: Reflected X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Mimecast-Bulk-Signature: yes X-Mimecast-Spam-Signature: bulk X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 11OBUbk9026479 X-loop: libvir-list@redhat.com Cc: liangpeng10@huawei.com, Michal Privoznik , xiexiangyou@huawei.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" qemuMonitorUnregister will be called in multiple threads (e.g. threads in rpc worker pool and the vm event thread). In some cases, it isn't protected by the monitor lock, which may lead to call g_source_unref more than one time and a use-after-free problem eventually. Add the missing lock in qemuProcessHandleMonitorEOF (which is the only position missing lock of monitor I found). Suggested-by: Michal Privoznik Signed-off-by: Peng Liang --- This patch is v2 of https://listman.redhat.com/archives/libvir-list/2021-Fe= bruary/msg00945.html. v1 -> v2: Locking monitor in qemuProcessHandleMonitorEOF instead of using aotmic function in qemuMonitorUnregister. src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_process.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index d25c26343a7f..14e6b1fe9626 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -427,6 +427,7 @@ bool qemuMonitorWasDisposed(void); =20 void qemuMonitorRegister(qemuMonitorPtr mon) ATTRIBUTE_NONNULL(1); +/* Must be called with monitor locked. */ void qemuMonitorUnregister(qemuMonitorPtr mon) ATTRIBUTE_NONNULL(1); void qemuMonitorClose(qemuMonitorPtr mon); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index d930ff9a74f6..bfa742577f32 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -318,7 +318,9 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon, /* We don't want this EOF handler to be called over and over while the * thread is waiting for a job. */ + virObjectLock(mon); qemuMonitorUnregister(mon); + virObjectUnlock(mon); =20 /* We don't want any cleanup from EOF handler (or any other * thread) to enter qemu namespace. */ --=20 2.29.2