From nobody Thu Nov 6 10:18:25 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1540818551350974.9937457561639; Mon, 29 Oct 2018 06:09:11 -0700 (PDT) Received: from localhost ([::1]:45456 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gH7I6-0000vW-8F for importer@patchew.org; Mon, 29 Oct 2018 09:09:10 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50162) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gH78I-0000H5-Vt for qemu-devel@nongnu.org; Mon, 29 Oct 2018 08:59:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gH78E-0002bj-T0 for qemu-devel@nongnu.org; Mon, 29 Oct 2018 08:59:02 -0400 Received: from smtp.nue.novell.com ([195.135.221.5]:55822) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gH78E-0002aD-It for qemu-devel@nongnu.org; Mon, 29 Oct 2018 08:58:58 -0400 Received: from localhost.localdomain ([45.122.156.254]) by smtp.nue.novell.com with ESMTP (NOT encrypted); Mon, 29 Oct 2018 13:58:54 +0100 From: Fei Li To: qemu-devel@nongnu.org Date: Mon, 29 Oct 2018 20:58:15 +0800 Message-Id: <20181029125818.28720-5-fli@suse.com> X-Mailer: git-send-email 2.13.7 In-Reply-To: <20181029125818.28720-1-fli@suse.com> References: <20181029125818.28720-1-fli@suse.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.135.221.5 Subject: [Qemu-devel] [PATCH RFC v6 4/7] migration: fix some segmentation faults when using multifd X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: quintela@redhat.com, famz@redhat.com, armbru@redhat.com, peterx@redhat.com, dgilbert@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" When multifd is used during migration, a segmentaion fault will occur in the source when multifd_save_cleanup() is called again if the multifd_send_state has been freed in earlier error handling. This can happen when migrate_fd_connect() fails and multifd_fd_cleanup() is called, and then multifd_new_send_channel_async() fails and multifd_save_cleanup() is called again. If the QIOChannel *c of multifd_recv_state->params[i] (p->c) is not initialized, there is no need to close the channel. Or else a segmentation fault will occur in multifd_recv_terminate_threads() when multifd_recv_initial_packet() fails. Signed-off-by: Fei Li --- migration/ram.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/migration/ram.c b/migration/ram.c index 7e7deec4d8..4db3b3e8f4 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -907,6 +907,11 @@ static void multifd_send_terminate_threads(Error *err) } } =20 + /* in case multifd_send_state has been freed earlier */ + if (!multifd_send_state) { + return; + } + for (i =3D 0; i < migrate_multifd_channels(); i++) { MultiFDSendParams *p =3D &multifd_send_state->params[i]; =20 @@ -922,7 +927,7 @@ int multifd_save_cleanup(Error **errp) int i; int ret =3D 0; =20 - if (!migrate_use_multifd()) { + if (!migrate_use_multifd() || !multifd_send_state) { return 0; } multifd_send_terminate_threads(NULL); @@ -960,7 +965,7 @@ static void multifd_send_sync_main(void) { int i; =20 - if (!migrate_use_multifd()) { + if (!migrate_use_multifd() || !multifd_send_state) { return; } if (multifd_send_state->pages->used) { @@ -1070,6 +1075,10 @@ static void multifd_new_send_channel_async(QIOTask *= task, gpointer opaque) QIOChannel *sioc =3D QIO_CHANNEL(qio_task_get_source(task)); Error *local_err =3D NULL; =20 + if (!multifd_send_state) { + return; + } + if (qio_task_propagate_error(task, &local_err)) { if (multifd_save_cleanup(&local_err) !=3D 0) { migrate_set_error(migrate_get_current(), local_err); @@ -1131,7 +1140,7 @@ struct { uint64_t packet_num; } *multifd_recv_state; =20 -static void multifd_recv_terminate_threads(Error *err) +static void multifd_recv_terminate_threads(Error *err, bool channel) { int i; =20 @@ -1145,6 +1154,11 @@ static void multifd_recv_terminate_threads(Error *er= r) } } =20 + /* in case p->c is not initialized */ + if (!channel) { + return; + } + for (i =3D 0; i < migrate_multifd_channels(); i++) { MultiFDRecvParams *p =3D &multifd_recv_state->params[i]; =20 @@ -1166,7 +1180,7 @@ int multifd_load_cleanup(Error **errp) if (!migrate_use_multifd()) { return 0; } - multifd_recv_terminate_threads(NULL); + multifd_recv_terminate_threads(NULL, true); for (i =3D 0; i < migrate_multifd_channels(); i++) { MultiFDRecvParams *p =3D &multifd_recv_state->params[i]; =20 @@ -1269,7 +1283,7 @@ static void *multifd_recv_thread(void *opaque) } =20 if (local_err) { - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, true); } qemu_mutex_lock(&p->mutex); p->running =3D false; @@ -1331,7 +1345,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) =20 id =3D multifd_recv_initial_packet(ioc, &local_err); if (id < 0) { - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, false); return false; } =20 @@ -1339,7 +1353,7 @@ bool multifd_recv_new_channel(QIOChannel *ioc) if (p->c !=3D NULL) { error_setg(&local_err, "multifd: received id '%d' already setup'", id); - multifd_recv_terminate_threads(local_err); + multifd_recv_terminate_threads(local_err, true); return false; } p->c =3D ioc; --=20 2.13.7