From nobody Wed May 8 01:29:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1545066777408877.1132005439949; Mon, 17 Dec 2018 09:12:57 -0800 (PST) Received: from localhost ([::1]:47862 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gYw8W-0005Bz-Ps for importer@patchew.org; Mon, 17 Dec 2018 11:52:56 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60397) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gYw79-0004Ux-Pp for qemu-devel@nongnu.org; Mon, 17 Dec 2018 11:51:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gYw74-0000ct-ME for qemu-devel@nongnu.org; Mon, 17 Dec 2018 11:51:31 -0500 Received: from mail-wm1-x341.google.com ([2a00:1450:4864:20::341]:51306) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gYw74-0000bm-Cy for qemu-devel@nongnu.org; Mon, 17 Dec 2018 11:51:26 -0500 Received: by mail-wm1-x341.google.com with SMTP id s14so13072669wmh.1 for ; Mon, 17 Dec 2018 08:51:26 -0800 (PST) Received: from mocramis-ultrabook.localdomain ([178.208.16.32]) by smtp.gmail.com with ESMTPSA id l20sm1024815wrb.93.2018.12.17.08.51.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 17 Dec 2018 08:51:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blade-group.com; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3lFGwn1xsbrUW134gouRfEsqiILsDvD2n6iuR2XAQQM=; b=YHBp76BlNXn+WVAwrT5Dx0VsSuYKUbgATQeevWtj2WDOhVZKb1ePtj/hvpnLjDFucv KPd+Dw0RO88N1gDMVAqb+1d5EBarglx28Jgse+bLGfAdgsSq3rOx5i81fIw4T06q2e2J GKRmtWke2UVCaulTT7ceSCfeortEsGDYKiLk0xkmC4J6qYjvqx8xXUlNSpHQZTKofXou UnI24rR+bFsbCZq+u0QlKdMxzJVDUE3Fp91tAvmb6NYR6gfhu4N+hqMByBcv6zuT3WyS hEMsdXgpQOBErNhaMPQybq19U+GpjJ1YFS0sQ+d38xJtoNwj2KrxNLrqX6Sr9G5Tn/WB 9TUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3lFGwn1xsbrUW134gouRfEsqiILsDvD2n6iuR2XAQQM=; b=ngBGcBJj3I8qkav2jbUA/dZXVpHeQd4SSfqvCNmMJ8tTcrT6QvR9oB49zR3czMnBX4 zsoFI2+p5WCYLQTK6W5sM4Pnu5kBmZEMgMoSx5IdP54IpR5iu9u6hzhyDlrb7Ie4A24k M5xwZruQXDnuTc9dno9TdQ02RRQO6OWRzG10HsVw4dKZjX4Vjt08WZds/C2xPCTQlW1V TmdkBWupSbF1kD84rlpvUd7nkr1tljMzOSj/It8AIygDGGyCtkKfbHRQHZvOFBCG4/vc GOm9r33jQmMTDvP+/L5I3BCx+kQhr3Nre+qdcGNuq3oit00rOMnU4vELeKclLQSOfOVq DQ3g== X-Gm-Message-State: AA+aEWbQCViq7iDnSFfeDZ4quju07Ip3CJVV8CSd5374kLkCgMAldTxf K9y9QcfW0FL0r0naL4dX/pA3h9PIFENrrQ== X-Google-Smtp-Source: AFSGD/WG8WNqmvV00IK62j8Y02BhfHiqR1rWeiJYkg80g0CAYwsCoizY0SPebv/pybMVth0ijteccg== X-Received: by 2002:a1c:8851:: with SMTP id k78mr12509009wmd.51.1545065484791; Mon, 17 Dec 2018 08:51:24 -0800 (PST) From: remy.noel@blade-group.com To: qemu-devel@nongnu.org Date: Mon, 17 Dec 2018 17:48:47 +0100 Message-Id: <20181217164847.24411-1-remy.noel@blade-group.com> X-Mailer: git-send-email 2.19.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::341 Subject: [Qemu-devel] [QEMU-devel][PATCH v3] aio-posix: Fix concurrent aio_poll/set_fd_handler. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fam Zheng , "open list:Block I/O path" , Stefan Weil , Remy Noel , Stefan Hajnoczi , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" From: Remy Noel It is possible for an io_poll callback to be concurrently executed along with an aio_set_fd_handlers. This can cause all sorts of problems, like a NULL callback or a bad opaque pointer. This changes set_fd_handlers so that it no longer modify existing handlers entries and instead, always insert those after having proper initialisation. Also, we do not call aio_epoll_update for deleted handlers as this has no impact whatsoever. Signed-off-by: Remy Noel Reviewed-by: Stefan Hajnoczi Tested-by: Stefan Hajnoczi --- util/aio-posix.c | 86 ++++++++++++++++++++++++++++-------------------- util/aio-win32.c | 67 ++++++++++++++++--------------------- 2 files changed, 79 insertions(+), 74 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index 51c41ed3c9..d658cf3007 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -200,6 +200,31 @@ static AioHandler *find_aio_handler(AioContext *ctx, i= nt fd) return NULL; } =20 +static bool aio_remove_fd_handler(AioContext *ctx, AioHandler *node) +{ + /* If the GSource is in the process of being destroyed then + * g_source_remove_poll() causes an assertion failure. Skip + * removal in that case, because glib cleans up its state during + * destruction anyway. + */ + if (!g_source_is_destroyed(&ctx->source)) { + g_source_remove_poll(&ctx->source, &node->pfd); + } + + /* If a read is in progress, just mark the node as deleted */ + if (qemu_lockcnt_count(&ctx->list_lock)) { + node->deleted =3D 1; + node->pfd.revents =3D 0; + return false; + } + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up while + * no one is walking the handlers list. + */ + QLIST_REMOVE(node, node); + return true; +} + void aio_set_fd_handler(AioContext *ctx, int fd, bool is_external, @@ -209,6 +234,7 @@ void aio_set_fd_handler(AioContext *ctx, void *opaque) { AioHandler *node; + AioHandler *new_node =3D NULL; bool is_new =3D false; bool deleted =3D false; int poll_disable_change; @@ -223,50 +249,36 @@ void aio_set_fd_handler(AioContext *ctx, qemu_lockcnt_unlock(&ctx->list_lock); return; } - - /* If the GSource is in the process of being destroyed then - * g_source_remove_poll() causes an assertion failure. Skip - * removal in that case, because glib cleans up its state during - * destruction anyway. - */ - if (!g_source_is_destroyed(&ctx->source)) { - g_source_remove_poll(&ctx->source, &node->pfd); - } - - /* If a read is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up while - * no one is walking the handlers list. - */ - QLIST_REMOVE(node, node); - deleted =3D true; - } poll_disable_change =3D -!node->io_poll; } else { poll_disable_change =3D !io_poll - (node && !node->io_poll); if (node =3D=3D NULL) { - /* Alloc and insert if it's not already there */ - node =3D g_new0(AioHandler, 1); - node->pfd.fd =3D fd; - QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); - - g_source_add_poll(&ctx->source, &node->pfd); is_new =3D true; } + /* Alloc and insert if it's not already there */ + new_node =3D g_new0(AioHandler, 1); =20 /* Update handler with latest information */ - node->io_read =3D io_read; - node->io_write =3D io_write; - node->io_poll =3D io_poll; - node->opaque =3D opaque; - node->is_external =3D is_external; + new_node->io_read =3D io_read; + new_node->io_write =3D io_write; + new_node->io_poll =3D io_poll; + new_node->opaque =3D opaque; + new_node->is_external =3D is_external; + + if (is_new) { + new_node->pfd.fd =3D fd; + } else { + new_node->pfd =3D node->pfd; + } + g_source_add_poll(&ctx->source, &new_node->pfd); + + new_node->pfd.events =3D (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR = : 0); + new_node->pfd.events |=3D (io_write ? G_IO_OUT | G_IO_ERR : 0); =20 - node->pfd.events =3D (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0); - node->pfd.events |=3D (io_write ? G_IO_OUT | G_IO_ERR : 0); + QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, new_node, node); + } + if (node) { + deleted =3D aio_remove_fd_handler(ctx, node); } =20 /* No need to order poll_disable_cnt writes against other updates; @@ -278,7 +290,9 @@ void aio_set_fd_handler(AioContext *ctx, atomic_set(&ctx->poll_disable_cnt, atomic_read(&ctx->poll_disable_cnt) + poll_disable_change); =20 - aio_epoll_update(ctx, node, is_new); + if (new_node) { + aio_epoll_update(ctx, new_node, is_new); + } qemu_lockcnt_unlock(&ctx->list_lock); aio_notify(ctx); =20 diff --git a/util/aio-win32.c b/util/aio-win32.c index c58957cc4b..a23b9c364d 100644 --- a/util/aio-win32.c +++ b/util/aio-win32.c @@ -35,6 +35,22 @@ struct AioHandler { QLIST_ENTRY(AioHandler) node; }; =20 +static void aio_remove_fd_handler(AioContext *ctx, AioHandler *node) +{ + /* If aio_poll is in progress, just mark the node as deleted */ + if (qemu_lockcnt_count(&ctx->list_lock)) { + node->deleted =3D 1; + node->pfd.revents =3D 0; + } else { + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up after + * releasing the list_lock. + */ + QLIST_REMOVE(node, node); + g_free(node); + } +} + void aio_set_fd_handler(AioContext *ctx, int fd, bool is_external, @@ -44,41 +60,23 @@ void aio_set_fd_handler(AioContext *ctx, void *opaque) { /* fd is a SOCKET in our case */ - AioHandler *node; + AioHandler *old_node; + AioHandler *node =3D NULL; =20 qemu_lockcnt_lock(&ctx->list_lock); - QLIST_FOREACH(node, &ctx->aio_handlers, node) { - if (node->pfd.fd =3D=3D fd && !node->deleted) { + QLIST_FOREACH(old_node, &ctx->aio_handlers, node) { + if (old_node->pfd.fd =3D=3D fd && !old_node->deleted) { break; } } =20 - /* Are we deleting the fd handler? */ - if (!io_read && !io_write) { - if (node) { - /* If aio_poll is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the list_lock. - */ - QLIST_REMOVE(node, node); - g_free(node); - } - } - } else { + if (io_read || io_write) { HANDLE event; long bitmask =3D 0; =20 - if (node =3D=3D NULL) { - /* Alloc and insert if it's not already there */ - node =3D g_new0(AioHandler, 1); - node->pfd.fd =3D fd; - QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); - } + /* Alloc and insert if it's not already there */ + node =3D g_new0(AioHandler, 1); + node->pfd.fd =3D fd; =20 node->pfd.events =3D 0; if (node->io_read) { @@ -104,9 +102,13 @@ void aio_set_fd_handler(AioContext *ctx, bitmask |=3D FD_WRITE | FD_CONNECT; } =20 + QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node); event =3D event_notifier_get_handle(&ctx->notifier); WSAEventSelect(node->pfd.fd, event, bitmask); } + if (old_node) { + aio_remove_fd_handler(ctx, old_node); + } =20 qemu_lockcnt_unlock(&ctx->list_lock); aio_notify(ctx); @@ -139,18 +141,7 @@ void aio_set_event_notifier(AioContext *ctx, if (node) { g_source_remove_poll(&ctx->source, &node->pfd); =20 - /* aio_poll is in progress, just mark the node as deleted */ - if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted =3D 1; - node->pfd.revents =3D 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the list_lock. - */ - QLIST_REMOVE(node, node); - g_free(node); - } + aio_remove_fd_handler(ctx, node); } } else { if (node =3D=3D NULL) { --=20 2.19.2