From nobody Thu Nov 6 08:11:02 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=gmail.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1540807516353302.29579673215505; Mon, 29 Oct 2018 03:05:16 -0700 (PDT) Received: from localhost ([::1]:44489 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gH4Q5-00067d-Bd for importer@patchew.org; Mon, 29 Oct 2018 06:05:13 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58375) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gH4P1-0005It-Sm for qemu-devel@nongnu.org; Mon, 29 Oct 2018 06:04:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gH4Ox-0003nW-Sd for qemu-devel@nongnu.org; Mon, 29 Oct 2018 06:04:07 -0400 Received: from mail-pf1-x444.google.com ([2607:f8b0:4864:20::444]:37676) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gH4Ow-0003ml-To for qemu-devel@nongnu.org; Mon, 29 Oct 2018 06:04:03 -0400 Received: by mail-pf1-x444.google.com with SMTP id j23-v6so3761118pfi.4 for ; Mon, 29 Oct 2018 03:04:02 -0700 (PDT) Received: from localhost ([203.100.54.194]) by smtp.gmail.com with ESMTPSA id u13-v6sm19426356pgp.18.2018.10.29.03.03.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Oct 2018 03:04:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:date:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=JYZYDUQ+mOFdldlp9Y4BMjBpazqOrjH1cSMRrgL/ezI=; b=jFR/cJMr1ua3HnszsgvN54QGdpsRAMxw2a4qZEAUr0A/h5Au3tJ7PjIaXh9tYGSHxW x64uHD/ph2+dOq38ew1PKshVroOWtvHxsN/1jX2XdesdMCSZ3I1Ec82JJN77YsnVfHTy ESGgOQQTc4J1ITC5F/+Z+8NiY6Tvt+os/5ggQlJY+0/RwV7GdYBE6+OvNId2E499/RuK S9nyIrQuxXXRWir46eQnD4inAW1Kv905YQuAsxJn+WeftGkUgwv/zMlDNVQxj+fNBmtT HQOOiBFkK3W6v4UuOL2rJprd8kn4/zwnFUMWTogHjR7VycqEaO6WiAi0VpbU4G2ivQSy TO3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:date:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=JYZYDUQ+mOFdldlp9Y4BMjBpazqOrjH1cSMRrgL/ezI=; b=dWL2cdT7JFMGjtqvPl0DoV0lsnhAxmso5pxlwgq+yYUl38Cfc3FERvEjpAI4ClU+di C7mo/GBcG5p5raxrgZhNzej5hTEuikEkE2XiYpsUrBv+GS6i1cREMqsMZVSOLP4bvBLV TVQe4HbMEsL/ZdBwK78b3nlG+9XZjK2G0KUys1KNlB6NMEcQKtN0Or2QX6ZSA54pnaCd 8a7ieKATVtIJo0CPP8AOu35uC9sXZngg1lJz8FxBdU+nDIXO5ZDzB/50wF3tcnaR9JoK 01JSYfxRbIMptV8IED26NgK6kvTrfRpi9hk/UGIvqMKfUtcLBtH71/O4YeQYXj364JiT IRnA== X-Gm-Message-State: AGRZ1gKbaEC2s7nb0exYkaJO9FZIOjRrxwoZwa8BNcvFn83UcWNNW9S5 yPUoT/FyvvUuC44QLDXcXkCwSOAf X-Google-Smtp-Source: AJdET5do6JpwDR61+FoDYcchhk3Uu1sSfrBe2xHhOpyN4aTG6/TiStKD1mQCXvLr4FFrvYMe/pgnQw== X-Received: by 2002:a63:2bc9:: with SMTP id r192mr13470035pgr.172.1540807441270; Mon, 29 Oct 2018 03:04:01 -0700 (PDT) From: Liang Li X-Google-Original-From: Liang Li Date: Mon, 29 Oct 2018 18:03:55 +0800 To: Juan Quintela , "Dr. David Alan Gilbert" , qemu-devel@nongnu.org Message-ID: <20181029100352.GA15627@localhost> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.7.2 (2016-11-26) X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::444 Subject: [Qemu-devel] [PATCH] migration: fix concurrent call of multifd_save_cleanup X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Liang Li Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Concurrent call of multifd_save_cleanup() is unsafe, it will lead to null pointer dereference. 'multifd_save_cleanup()' should not be called in multifd_new_send_channel_async(), move it to ram_save_cleanup() like other features do. Signed-off-by: Liang Li --- migration/migration.c | 5 ----- migration/ram.c | 7 +++---- migration/ram.h | 2 +- 3 files changed, 4 insertions(+), 10 deletions(-) diff --git a/migration/migration.c b/migration/migration.c index 8b36e7f..f422218 100644 --- a/migration/migration.c +++ b/migration/migration.c @@ -1372,7 +1372,6 @@ static void migrate_fd_cleanup(void *opaque) qemu_savevm_state_cleanup(); =20 if (s->to_dst_file) { - Error *local_err =3D NULL; QEMUFile *tmp; =20 trace_migrate_fd_cleanup(); @@ -1382,10 +1381,6 @@ static void migrate_fd_cleanup(void *opaque) s->migration_thread_running =3D false; } qemu_mutex_lock_iothread(); - - if (multifd_save_cleanup(&local_err) !=3D 0) { - error_report_err(local_err); - } qemu_mutex_lock(&s->qemu_file_lock); tmp =3D s->to_dst_file; s->to_dst_file =3D NULL; diff --git a/migration/ram.c b/migration/ram.c index 7e7deec..a232b9c 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -917,7 +917,7 @@ static void multifd_send_terminate_threads(Error *err) } } =20 -int multifd_save_cleanup(Error **errp) +int multifd_save_cleanup(void) { int i; int ret =3D 0; @@ -1071,9 +1071,7 @@ static void multifd_new_send_channel_async(QIOTask *t= ask, gpointer opaque) Error *local_err =3D NULL; =20 if (qio_task_propagate_error(task, &local_err)) { - if (multifd_save_cleanup(&local_err) !=3D 0) { - migrate_set_error(migrate_get_current(), local_err); - } + migrate_set_error(migrate_get_current(), local_err); } else { p->c =3D QIO_CHANNEL(sioc); qio_channel_set_delay(p->c, false); @@ -2542,6 +2540,7 @@ static void ram_save_cleanup(void *opaque) =20 xbzrle_cleanup(); compress_threads_save_cleanup(); + multifd_save_cleanup(); ram_state_cleanup(rsp); } =20 diff --git a/migration/ram.h b/migration/ram.h index 83ff1bc..c4fafea 100644 --- a/migration/ram.h +++ b/migration/ram.h @@ -43,7 +43,7 @@ uint64_t ram_bytes_remaining(void); uint64_t ram_bytes_total(void); =20 int multifd_save_setup(void); -int multifd_save_cleanup(Error **errp); +int multifd_save_cleanup(void); int multifd_load_setup(void); int multifd_load_cleanup(Error **errp); bool multifd_recv_all_channels_created(void); --=20 1.8.3.1