From nobody Fri Apr 19 18:32:34 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1544091352116432.84719718761414; Thu, 6 Dec 2018 02:15:52 -0800 (PST) Received: from localhost ([::1]:39924 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUqh5-000765-56 for importer@patchew.org; Thu, 06 Dec 2018 05:15:43 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47282) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUqfj-0006ZT-Jg for qemu-devel@nongnu.org; Thu, 06 Dec 2018 05:14:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gUqfe-0002Ce-E0 for qemu-devel@nongnu.org; Thu, 06 Dec 2018 05:14:18 -0500 Received: from mail-wm1-x343.google.com ([2a00:1450:4864:20::343]:51680) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gUqfd-0002CC-Ra for qemu-devel@nongnu.org; Thu, 06 Dec 2018 05:14:14 -0500 Received: by mail-wm1-x343.google.com with SMTP id s14so389234wmh.1 for ; Thu, 06 Dec 2018 02:14:13 -0800 (PST) Received: from mocramis-ultrabook.localdomain ([178.208.16.32]) by smtp.gmail.com with ESMTPSA id h131sm466305wmd.17.2018.12.06.02.14.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Dec 2018 02:14:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blade-group.com; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Lt9EIp2Qe+BGsgQZspERWCFWYGynF6IW73NeKqEgjRs=; b=Vd5/YcT+n3SQfrwUqOYG8WvD0GvND577errbZmDaiGbseYMUXCKrddVsjZDC/q+cpT xXipJmf2UztI7F/hsjLjXmF6Uo3QUyt9GcKl4Sx/+Zo6cTlv2gEpoXHeC9NARC+HYHri n/iJMLSfWnPn3naWaToJOF4yLvEDSPQJh4r8XOMCnf7rK/S7hJ/OLG+T6W7M1bfny1My ocYuSUBQjXNCWqUfeRMpTH+OGL+ZxuMrweSqZXQgUvm1P2ynIGAI2+92jXiWqLxZQN/G VzwUQWkLcdsr8cNid+wBkIoJURx1jb4s/kE7roZs3Tg6BQTIuKs2r/6dSTxDlEDRTg/n w5kQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Lt9EIp2Qe+BGsgQZspERWCFWYGynF6IW73NeKqEgjRs=; b=QVqRPvIbK74ZPgxKwakKDINlHWVS1vIUmYz3oRnLOOTe+GU/crG9ikfoF/qmHYKss7 LI6DkGpdz9FzUo8tUBikDB6KNZmqpZlmnPSm5rdCLQJfeCKGbXEfcBfcm78y4zTW+ieT +nNfLDbQthO3c4kHqFiFJLdPXBPdEOTmmrlU8jDC699HIUK/M8oj5+NVYfB2XZC087W7 hVQtPoglwt+Uvm0iUjpVhRoneBfyqx8rVGbw0f14i9shA/JZe2AbJVIurY/FsVL6++w8 5RP3VM/Vr/Fr0jO4MNvmwXAgUlTRNnOLd0fpOeq1JOjGtnPVCdiwQYTLipeAkaINr66+ WgFA== X-Gm-Message-State: AA+aEWYRr40xfB6QkhS4xynGySTbo/WiWNrhqIytrJq2P3cupbDlFeN1 YI/i788XZlDwqxwPMfH5XioZo6AtbsQOGg== X-Google-Smtp-Source: AFSGD/VVjcSWRH2hyf1XT9vVRHSfitmtABMN3miFKdgkgwqJRRpM8la3ZTgoDLummtTeiftKdcTXqg== X-Received: by 2002:a7b:c34c:: with SMTP id l12mr1605852wmj.147.1544091251707; Thu, 06 Dec 2018 02:14:11 -0800 (PST) From: remy.noel@blade-group.com To: qemu-devel@nongnu.org Date: Thu, 6 Dec 2018 11:14:23 +0100 Message-Id: <20181206101423.17344-1-remy.noel@blade-group.com> X-Mailer: git-send-email 2.19.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::343 Subject: [Qemu-devel] [QEMU-devel][PATCH v2] aio-posix: Fix concurrent aio_poll/set_fd_handler. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fam Zheng , "open list:Block I/O path" , Stefan Weil , Remy Noel , Stefan Hajnoczi , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. This changes set_fd_handlers so that it no longer modify existing handlers entries and instead, always insert those after having proper initialisation. Also, we do not call aio_epoll_update for deleted handlers as this has no impact whatsoever. Signed-off-by: Remy Noel --- util/aio-posix.c | 85 ++++++++++++++++++++++++++++-------------------- util/aio-win32.c | 54 ++++++++++++++---------------- 2 files changed, 74 insertions(+), 65 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index 51c41ed3c9..b34d97292a 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -200,6 +200,31 @@ static AioHandler *find_aio_handler(AioContext *ctx, i= nt fd) return NULL; } =20 +static bool aio_remove_fd_handler(AioContext *ctx, AioHandler *node) +{ + /* If the GSource is in the process of being destroyed then + * g_source_remove_poll() causes an assertion failure. Skip + * removal in that case, because glib cleans up its state during + * destruction anyway. + */ + if (!g_source_is_destroyed(&ctx->source)) { + g_source_remove_poll(&ctx->source, &node->pfd); + } + + /* If a read is in progress, just mark the node as deleted */ + if (qemu_lockcnt_count(&ctx->list_lock)) { + node->deleted =3D 1; + node->pfd.revents =3D 0; + return false; + } + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up while + * no one is walking the handlers list. + */ + QLIST_REMOVE(node, node); + return true; +} + void aio_set_fd_handler(AioContext *ctx, int fd, bool is_external, @@ -209,6 +234,7 @@ void aio_set_fd_handler(AioContext *ctx, void *opaque) { AioHandler *node; + AioHandler *new_node =3D NULL; bool is_new =3D false; bool deleted =3D false; int poll_disable_change; @@ -223,50 +249,35 @@ void aio_set_fd_handler(AioContext *ctx, qemu_lockcnt_unlock(&ctx->list_lock); return; } - - /* If the GSource is in the process of being destroyed then - * g_source_remove_poll() causes an assertion failure. Skip - * removal in that case, because glib cleans up its state during - * destruction anyway. - */ - if (!g_source_is_destroyed(&ctx->source)) { - g_source_remove_poll(&ctx->source, &node->pfd); - } - - /* If a read is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up while - * no one is walking the handlers list. - */ - QLIST_REMOVE(node, node); - deleted =3D true; - } + deleted =3D aio_remove_fd_handler(ctx, node); poll_disable_change =3D -!node->io_poll; } else { poll_disable_change =3D !io_poll - (node && !node->io_poll); if (node =3D=3D NULL) { - /* Alloc and insert if it's not already there */ - node =3D g_new0(AioHandler, 1); - node->pfd.fd =3D fd; - QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); - - g_source_add_poll(&ctx->source, &node->pfd); is_new =3D true; } + /* Alloc and insert if it's not already there */ + new_node =3D g_new0(AioHandler, 1); =20 /* Update handler with latest information */ - node->io_read =3D io_read; - node->io_write =3D io_write; - node->io_poll =3D io_poll; - node->opaque =3D opaque; - node->is_external =3D is_external; + new_node->io_read =3D io_read; + new_node->io_write =3D io_write; + new_node->io_poll =3D io_poll; + new_node->opaque =3D opaque; + new_node->is_external =3D is_external; + + if (is_new) { + new_node->pfd.fd =3D fd; + } else { + deleted =3D aio_remove_fd_handler(ctx, node); + new_node->pfd =3D node->pfd; + } + g_source_add_poll(&ctx->source, &new_node->pfd); =20 - node->pfd.events =3D (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0); - node->pfd.events |=3D (io_write ? G_IO_OUT | G_IO_ERR : 0); + new_node->pfd.events =3D (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR = : 0); + new_node->pfd.events |=3D (io_write ? G_IO_OUT | G_IO_ERR : 0); + + QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, new_node, node); } =20 /* No need to order poll_disable_cnt writes against other updates; @@ -278,7 +289,9 @@ void aio_set_fd_handler(AioContext *ctx, atomic_set(&ctx->poll_disable_cnt, atomic_read(&ctx->poll_disable_cnt) + poll_disable_change); =20 - aio_epoll_update(ctx, node, is_new); + if (new_node) { + aio_epoll_update(ctx, new_node, is_new); + } qemu_lockcnt_unlock(&ctx->list_lock); aio_notify(ctx); =20 diff --git a/util/aio-win32.c b/util/aio-win32.c index c58957cc4b..00e38cdd9f 100644 --- a/util/aio-win32.c +++ b/util/aio-win32.c @@ -35,6 +35,22 @@ struct AioHandler { QLIST_ENTRY(AioHandler) node; }; =20 +static void aio_remove_fd_handler(AioContext *ctx, AioHandler *node) +{ + /* If aio_poll is in progress, just mark the node as deleted */ + if (qemu_lockcnt_count(&ctx->list_lock)) { + node->deleted =3D 1; + node->pfd.revents =3D 0; + } else { + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up after + * releasing the list_lock. + */ + QLIST_REMOVE(node, node); + g_free(node); + } +} + void aio_set_fd_handler(AioContext *ctx, int fd, bool is_external, @@ -56,30 +72,20 @@ void aio_set_fd_handler(AioContext *ctx, /* Are we deleting the fd handler? */ if (!io_read && !io_write) { if (node) { - /* If aio_poll is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the list_lock. - */ - QLIST_REMOVE(node, node); - g_free(node); - } + aio_remove_fd_handler(ctx, node); } } else { HANDLE event; long bitmask =3D 0; =20 - if (node =3D=3D NULL) { - /* Alloc and insert if it's not already there */ - node =3D g_new0(AioHandler, 1); - node->pfd.fd =3D fd; - QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); + if (node) { + aio_remove_fd_handler(ctx, node); } =20 + /* Alloc and insert if it's not already there */ + node =3D g_new0(AioHandler, 1); + node->pfd.fd =3D fd; + node->pfd.events =3D 0; if (node->io_read) { node->pfd.events |=3D G_IO_IN; @@ -104,6 +110,7 @@ void aio_set_fd_handler(AioContext *ctx, bitmask |=3D FD_WRITE | FD_CONNECT; } =20 + QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); event =3D event_notifier_get_handle(&ctx->notifier); WSAEventSelect(node->pfd.fd, event, bitmask); } @@ -139,18 +146,7 @@ void aio_set_event_notifier(AioContext *ctx, if (node) { g_source_remove_poll(&ctx->source, &node->pfd); =20 - /* aio_poll is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the list_lock. - */ - QLIST_REMOVE(node, node); - g_free(node); - } + aio_remove_fd_handler(ctx, node); } } else { if (node =3D=3D NULL) { --=20 2.19.2