1. Patchew
  2. QEMU
  3. View series

[Qemu-devel] [PATCH] iothread: fix crash with invalid properties

Marc-André Lureau posted 1 patch 7 years, 2 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20180821100716.13803-1-marcandre.lureau@redhat.com
Test checkpatch passed
Test docker-mingw@fedora passed
Test docker-clang@ubuntu failed
Test docker-quick@centos7 passed
iothread.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
[Qemu-devel] [PATCH] iothread: fix crash with invalid properties
Posted by Marc-André Lureau 7 years, 2 months ago 
-object iothread,id=foo,? will crash qemu:

qemu-system-x86_64:qemu-thread-posix.c:128: qemu_cond_destroy: Assertion `cond->initialized' failed.

Use thread_id != -1 to check if iothread_complete() finished
successfully and the mutex/cond have been initialized.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 iothread.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/iothread.c b/iothread.c
index aff1281257..2fb1cdf55d 100644
--- a/iothread.c
+++ b/iothread.c
@@ -110,6 +110,7 @@ static void iothread_instance_init(Object *obj)
     IOThread *iothread = IOTHREAD(obj);
 
     iothread->poll_max_ns = IOTHREAD_POLL_MAX_NS_DEFAULT;
+    iothread->thread_id = -1;
 }
 
 static void iothread_instance_finalize(Object *obj)
@@ -117,6 +118,11 @@ static void iothread_instance_finalize(Object *obj)
     IOThread *iothread = IOTHREAD(obj);
 
     iothread_stop(iothread);
+
+    if (iothread->thread_id != -1) {
+        qemu_cond_destroy(&iothread->init_done_cond);
+        qemu_mutex_destroy(&iothread->init_done_lock);
+    }
     /*
      * Before glib2 2.33.10, there is a glib2 bug that GSource context
      * pointer may not be cleared even if the context has already been
@@ -135,8 +141,6 @@ static void iothread_instance_finalize(Object *obj)
         g_main_context_unref(iothread->worker_context);
         iothread->worker_context = NULL;
     }
-    qemu_cond_destroy(&iothread->init_done_cond);
-    qemu_mutex_destroy(&iothread->init_done_lock);
 }
 
 static void iothread_complete(UserCreatable *obj, Error **errp)
@@ -147,7 +151,6 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
 
     iothread->stopping = false;
     iothread->running = true;
-    iothread->thread_id = -1;
     iothread->ctx = aio_context_new(&local_error);
     if (!iothread->ctx) {
         error_propagate(errp, local_error);
-- 
2.18.0.547.g1d89318c48
Re: [Qemu-devel] [PATCH] iothread: fix crash with invalid properties
Posted by Marc-André Lureau 7 years, 2 months ago 
ping
On Tue, Aug 21, 2018 at 12:07 PM Marc-André Lureau
<marcandre.lureau@redhat.com> wrote:
>
> -object iothread,id=foo,? will crash qemu:
>
> qemu-system-x86_64:qemu-thread-posix.c:128: qemu_cond_destroy: Assertion `cond->initialized' failed.
>
> Use thread_id != -1 to check if iothread_complete() finished
> successfully and the mutex/cond have been initialized.
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  iothread.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/iothread.c b/iothread.c
> index aff1281257..2fb1cdf55d 100644
> --- a/iothread.c
> +++ b/iothread.c
> @@ -110,6 +110,7 @@ static void iothread_instance_init(Object *obj)
>      IOThread *iothread = IOTHREAD(obj);
>
>      iothread->poll_max_ns = IOTHREAD_POLL_MAX_NS_DEFAULT;
> +    iothread->thread_id = -1;
>  }
>
>  static void iothread_instance_finalize(Object *obj)
> @@ -117,6 +118,11 @@ static void iothread_instance_finalize(Object *obj)
>      IOThread *iothread = IOTHREAD(obj);
>
>      iothread_stop(iothread);
> +
> +    if (iothread->thread_id != -1) {
> +        qemu_cond_destroy(&iothread->init_done_cond);
> +        qemu_mutex_destroy(&iothread->init_done_lock);
> +    }
>      /*
>       * Before glib2 2.33.10, there is a glib2 bug that GSource context
>       * pointer may not be cleared even if the context has already been
> @@ -135,8 +141,6 @@ static void iothread_instance_finalize(Object *obj)
>          g_main_context_unref(iothread->worker_context);
>          iothread->worker_context = NULL;
>      }
> -    qemu_cond_destroy(&iothread->init_done_cond);
> -    qemu_mutex_destroy(&iothread->init_done_lock);
>  }
>
>  static void iothread_complete(UserCreatable *obj, Error **errp)
> @@ -147,7 +151,6 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
>
>      iothread->stopping = false;
>      iothread->running = true;
> -    iothread->thread_id = -1;
>      iothread->ctx = aio_context_new(&local_error);
>      if (!iothread->ctx) {
>          error_propagate(errp, local_error);
> --
> 2.18.0.547.g1d89318c48
>
>


-- 
Marc-André Lureau
Re: [Qemu-devel] [PATCH] iothread: fix crash with invalid properties
Posted by Fam Zheng 7 years, 1 month ago 
On Tue, 08/21 12:07, Marc-André Lureau wrote:
> -object iothread,id=foo,? will crash qemu:
> 
> qemu-system-x86_64:qemu-thread-posix.c:128: qemu_cond_destroy: Assertion `cond->initialized' failed.
> 
> Use thread_id != -1 to check if iothread_complete() finished
> successfully and the mutex/cond have been initialized.
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  iothread.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/iothread.c b/iothread.c
> index aff1281257..2fb1cdf55d 100644
> --- a/iothread.c
> +++ b/iothread.c
> @@ -110,6 +110,7 @@ static void iothread_instance_init(Object *obj)
>      IOThread *iothread = IOTHREAD(obj);
>  
>      iothread->poll_max_ns = IOTHREAD_POLL_MAX_NS_DEFAULT;
> +    iothread->thread_id = -1;
>  }
>  
>  static void iothread_instance_finalize(Object *obj)
> @@ -117,6 +118,11 @@ static void iothread_instance_finalize(Object *obj)
>      IOThread *iothread = IOTHREAD(obj);
>  
>      iothread_stop(iothread);
> +
> +    if (iothread->thread_id != -1) {
> +        qemu_cond_destroy(&iothread->init_done_cond);
> +        qemu_mutex_destroy(&iothread->init_done_lock);
> +    }
>      /*
>       * Before glib2 2.33.10, there is a glib2 bug that GSource context
>       * pointer may not be cleared even if the context has already been
> @@ -135,8 +141,6 @@ static void iothread_instance_finalize(Object *obj)
>          g_main_context_unref(iothread->worker_context);
>          iothread->worker_context = NULL;
>      }
> -    qemu_cond_destroy(&iothread->init_done_cond);
> -    qemu_mutex_destroy(&iothread->init_done_lock);

Is there a reason for the reordering against aio_context_unref() and
g_main_context_unref()? The patch otherwise looks good to me.

Fam

>  }
>  
>  static void iothread_complete(UserCreatable *obj, Error **errp)
> @@ -147,7 +151,6 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
>  
>      iothread->stopping = false;
>      iothread->running = true;
> -    iothread->thread_id = -1;
>      iothread->ctx = aio_context_new(&local_error);
>      if (!iothread->ctx) {
>          error_propagate(errp, local_error);
> -- 
> 2.18.0.547.g1d89318c48
> 
>
Re: [Qemu-devel] [PATCH] iothread: fix crash with invalid properties
Posted by Marc-André Lureau 7 years, 1 month ago 
Hi

On Wed, Sep 26, 2018 at 12:13 PM Fam Zheng <famz@redhat.com> wrote:
>
> On Tue, 08/21 12:07, Marc-André Lureau wrote:
> > -object iothread,id=foo,? will crash qemu:
> >
> > qemu-system-x86_64:qemu-thread-posix.c:128: qemu_cond_destroy: Assertion `cond->initialized' failed.
> >
> > Use thread_id != -1 to check if iothread_complete() finished
> > successfully and the mutex/cond have been initialized.
> >
> > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > ---
> >  iothread.c | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/iothread.c b/iothread.c
> > index aff1281257..2fb1cdf55d 100644
> > --- a/iothread.c
> > +++ b/iothread.c
> > @@ -110,6 +110,7 @@ static void iothread_instance_init(Object *obj)
> >      IOThread *iothread = IOTHREAD(obj);
> >
> >      iothread->poll_max_ns = IOTHREAD_POLL_MAX_NS_DEFAULT;
> > +    iothread->thread_id = -1;
> >  }
> >
> >  static void iothread_instance_finalize(Object *obj)
> > @@ -117,6 +118,11 @@ static void iothread_instance_finalize(Object *obj)
> >      IOThread *iothread = IOTHREAD(obj);
> >
> >      iothread_stop(iothread);
> > +
> > +    if (iothread->thread_id != -1) {
> > +        qemu_cond_destroy(&iothread->init_done_cond);
> > +        qemu_mutex_destroy(&iothread->init_done_lock);
> > +    }
> >      /*
> >       * Before glib2 2.33.10, there is a glib2 bug that GSource context
> >       * pointer may not be cleared even if the context has already been
> > @@ -135,8 +141,6 @@ static void iothread_instance_finalize(Object *obj)
> >          g_main_context_unref(iothread->worker_context);
> >          iothread->worker_context = NULL;
> >      }
> > -    qemu_cond_destroy(&iothread->init_done_cond);
> > -    qemu_mutex_destroy(&iothread->init_done_lock);
>
> Is there a reason for the reordering against aio_context_unref() and
> g_main_context_unref()? The patch otherwise looks good to me.

Not that I remember,

Feel free to move on commit, or I can resend.

Thanks

>
> Fam
>
> >  }
> >
> >  static void iothread_complete(UserCreatable *obj, Error **errp)
> > @@ -147,7 +151,6 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
> >
> >      iothread->stopping = false;
> >      iothread->running = true;
> > -    iothread->thread_id = -1;
> >      iothread->ctx = aio_context_new(&local_error);
> >      if (!iothread->ctx) {
> >          error_propagate(errp, local_error);
> > --
> > 2.18.0.547.g1d89318c48
> >
> >
>


-- 
Marc-André Lureau
Re: [Qemu-devel] [PATCH] iothread: fix crash with invalid properties
Posted by Fam Zheng 7 years, 1 month ago 
On Wed, 09/26 12:33, Marc-André Lureau wrote:
> Hi
> 
> On Wed, Sep 26, 2018 at 12:13 PM Fam Zheng <famz@redhat.com> wrote:
> >
> > On Tue, 08/21 12:07, Marc-André Lureau wrote:
> > > -object iothread,id=foo,? will crash qemu:
> > >
> > > qemu-system-x86_64:qemu-thread-posix.c:128: qemu_cond_destroy: Assertion `cond->initialized' failed.
> > >
> > > Use thread_id != -1 to check if iothread_complete() finished
> > > successfully and the mutex/cond have been initialized.
> > >
> > > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > > ---
> > >  iothread.c | 9 ++++++---
> > >  1 file changed, 6 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/iothread.c b/iothread.c
> > > index aff1281257..2fb1cdf55d 100644
> > > --- a/iothread.c
> > > +++ b/iothread.c
> > > @@ -110,6 +110,7 @@ static void iothread_instance_init(Object *obj)
> > >      IOThread *iothread = IOTHREAD(obj);
> > >
> > >      iothread->poll_max_ns = IOTHREAD_POLL_MAX_NS_DEFAULT;
> > > +    iothread->thread_id = -1;
> > >  }
> > >
> > >  static void iothread_instance_finalize(Object *obj)
> > > @@ -117,6 +118,11 @@ static void iothread_instance_finalize(Object *obj)
> > >      IOThread *iothread = IOTHREAD(obj);
> > >
> > >      iothread_stop(iothread);
> > > +
> > > +    if (iothread->thread_id != -1) {
> > > +        qemu_cond_destroy(&iothread->init_done_cond);
> > > +        qemu_mutex_destroy(&iothread->init_done_lock);
> > > +    }
> > >      /*
> > >       * Before glib2 2.33.10, there is a glib2 bug that GSource context
> > >       * pointer may not be cleared even if the context has already been
> > > @@ -135,8 +141,6 @@ static void iothread_instance_finalize(Object *obj)
> > >          g_main_context_unref(iothread->worker_context);
> > >          iothread->worker_context = NULL;
> > >      }
> > > -    qemu_cond_destroy(&iothread->init_done_cond);
> > > -    qemu_mutex_destroy(&iothread->init_done_lock);
> >
> > Is there a reason for the reordering against aio_context_unref() and
> > g_main_context_unref()? The patch otherwise looks good to me.
> 
> Not that I remember,
> 
> Feel free to move on commit, or I can resend.

No problem, queued as is.

Fam

> 
> Thanks
> 
> >
> > Fam
> >
> > >  }
> > >
> > >  static void iothread_complete(UserCreatable *obj, Error **errp)
> > > @@ -147,7 +151,6 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
> > >
> > >      iothread->stopping = false;
> > >      iothread->running = true;
> > > -    iothread->thread_id = -1;
> > >      iothread->ctx = aio_context_new(&local_error);
> > >      if (!iothread->ctx) {
> > >          error_propagate(errp, local_error);
> > > --
> > > 2.18.0.547.g1d89318c48
> > >
> > >
> >
> 
> 
> -- 
> Marc-André Lureau

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.