From nobody Fri May 3 10:58:32 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1616427805; cv=none; d=zohomail.com; s=zohoarc; b=MTR+1ih+Ytha3LGpRqhWAoZ1XRaU6tvTw50sK8B+0s8wsK1iT8wmt3LqzjRmr9txnj76f9vxJSpevEmK5ld2Pj8pIvPN6dwpq6HXrccxI3Q0Ydog+lPoDxwmXs47FXYdBVFC+D865a6uy0P/ZH9TCE3o1sLCg0MHEhDVcZZG2hg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1616427805; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=SvJImgsJWXJGDrseKN1AZbZM1NH/xfbn0dIjKZM4r+Q=; b=iaMV2VayoKg1d8KqNRhfW477uJV+Mlk2lVl2JYDRB2+ecUdJW0tKEkkGOpp5Ee7TDnXRJCt9ra6oF8Ns+PwCdnnKQ8c0N8Pet+geFGKWha0IWgZxqZmSiVIA2i8kzsWe3rX7S8UqC4ahnnR/AuZ7jIV/BwICRGUAXhFmTBpiBEo= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1616427805191302.2301695639818; Mon, 22 Mar 2021 08:43:25 -0700 (PDT) Received: from localhost ([::1]:49006 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lOMiB-0001Wc-Ls for importer@patchew.org; Mon, 22 Mar 2021 11:43:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37110) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lOMfb-0008NB-M8 for qemu-devel@nongnu.org; Mon, 22 Mar 2021 11:40:48 -0400 Received: from proxmox-new.maurer-it.com ([212.186.127.180]:52970) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lOMfY-0004bl-Fg for qemu-devel@nongnu.org; Mon, 22 Mar 2021 11:40:43 -0400 Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 7F35B42697; Mon, 22 Mar 2021 16:40:37 +0100 (CET) From: Stefan Reiter To: Markus Armbruster , Kevin Wolf , Paolo Bonzini , Wolfgang Bumiller , Thomas Lamprecht Subject: [PATCH v2] monitor/qmp: fix race on CHR_EVENT_CLOSED without OOB Date: Mon, 22 Mar 2021 16:40:24 +0100 Message-Id: <20210322154024.15011-1-s.reiter@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.186.127.180; envelope-from=s.reiter@proxmox.com; helo=proxmox-new.maurer-it.com X-Spam_score_int: -41 X-Spam_score: -4.2 X-Spam_bar: ---- X-Spam_report: (-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" The QMP dispatcher coroutine holds the qmp_queue_lock over a yield point, where it expects to be rescheduled from the main context. If a CHR_EVENT_CLOSED event is received just then, it can race and block the main thread on the mutex in monitor_qmp_cleanup_queue_and_resume. monitor_resume does not need to be called from main context, so we can call it immediately after popping a request from the queue, which allows us to drop the qmp_queue_lock mutex before yielding. Suggested-by: Wolfgang Bumiller Signed-off-by: Stefan Reiter Reviewed-by: Kevin Wolf --- v2: * different approach: move everything that needs the qmp_queue_lock mutex b= efore the yield point, instead of moving the event handling to a different cont= ext monitor/qmp.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/monitor/qmp.c b/monitor/qmp.c index 2b0308f933..092c527b6f 100644 --- a/monitor/qmp.c +++ b/monitor/qmp.c @@ -257,24 +257,6 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data) trace_monitor_qmp_in_band_dequeue(req_obj, req_obj->mon->qmp_requests->leng= th); =20 - if (qatomic_xchg(&qmp_dispatcher_co_busy, true) =3D=3D true) { - /* - * Someone rescheduled us (probably because a new requests - * came in), but we didn't actually yield. Do that now, - * only to be immediately reentered and removed from the - * list of scheduled coroutines. - */ - qemu_coroutine_yield(); - } - - /* - * Move the coroutine from iohandler_ctx to qemu_aio_context for - * executing the command handler so that it can make progress if it - * involves an AIO_WAIT_WHILE(). - */ - aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co); - qemu_coroutine_yield(); - /* * @req_obj has a request, we hold req_obj->mon->qmp_queue_lock */ @@ -298,8 +280,30 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data) monitor_resume(&mon->common); } =20 + /* + * Drop the queue mutex now, before yielding, otherwise we might + * deadlock if the main thread tries to lock it. + */ qemu_mutex_unlock(&mon->qmp_queue_lock); =20 + if (qatomic_xchg(&qmp_dispatcher_co_busy, true) =3D=3D true) { + /* + * Someone rescheduled us (probably because a new requests + * came in), but we didn't actually yield. Do that now, + * only to be immediately reentered and removed from the + * list of scheduled coroutines. + */ + qemu_coroutine_yield(); + } + + /* + * Move the coroutine from iohandler_ctx to qemu_aio_context for + * executing the command handler so that it can make progress if it + * involves an AIO_WAIT_WHILE(). + */ + aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co); + qemu_coroutine_yield(); + /* Process request */ if (req_obj->req) { if (trace_event_get_state(TRACE_MONITOR_QMP_CMD_IN_BAND)) { --=20 2.20.1