migration_incoming_state_destroy() NULLs all objects it frees after they
are freed, presumably so that a subsequent call to the same function
will not free them again, unless new objects have been created in the
meantime.

transport_data is the exception, and it shows exactly this problem: When
an incoming migration uses transport_cleanup() and transport_data, and a
subsequent incoming migration (e.g. loadvm) occurs that does not, then
when this second one is done, it will call transport_cleanup() on the
old transport_data again -- which has already been freed.  This is
sometimes visible in the iotest 201, though for some reason I can only
reproduce it with -m32.

To fix this, call transport_cleanup() only when transport_data is not
NULL (otherwise there is nothing to clean up), and set transport_data to
NULL when it has been cleaned up (i.e. freed).

(transport_cleanup() is used only by migration/socket.c, where
socket_start_incoming_migration_internal() sets both it and
transport_data to non-NULL values.)

Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 migration/migration.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/migration/migration.c b/migration/migration.c
index bcc385b94b..cdb2e76d02 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -287,8 +287,9 @@ void migration_incoming_state_destroy(void)
         g_array_free(mis->postcopy_remote_fds, TRUE);
         mis->postcopy_remote_fds = NULL;
     }
-    if (mis->transport_cleanup) {
+    if (mis->transport_cleanup && mis->transport_data) {
         mis->transport_cleanup(mis->transport_data);
+        mis->transport_data = NULL;
     }
 
     qemu_event_reset(&mis->main_thread_load_event);
-- 
2.34.1

On Thu, Feb 17, 2022 at 06:04:07PM +0100, Hanna Reitz wrote:
> migration_incoming_state_destroy() NULLs all objects it frees after they
> are freed, presumably so that a subsequent call to the same function
> will not free them again, unless new objects have been created in the
> meantime.
> 
> transport_data is the exception, and it shows exactly this problem: When
> an incoming migration uses transport_cleanup() and transport_data, and a
> subsequent incoming migration (e.g. loadvm) occurs that does not, then
> when this second one is done, it will call transport_cleanup() on the
> old transport_data again -- which has already been freed.  This is
> sometimes visible in the iotest 201, though for some reason I can only
> reproduce it with -m32.
> 
> To fix this, call transport_cleanup() only when transport_data is not
> NULL (otherwise there is nothing to clean up), and set transport_data to
> NULL when it has been cleaned up (i.e. freed).
> 
> (transport_cleanup() is used only by migration/socket.c, where
> socket_start_incoming_migration_internal() sets both it and
> transport_data to non-NULL values.)
> 
> Signed-off-by: Hanna Reitz <hreitz@redhat.com>

I had a similar fix here:

https://lore.kernel.org/qemu-devel/20220216062809.57179-15-peterx@redhat.com/

Though there it was because I need migration_incoming_transport_cleanup()
for other purposes, so the fix came along.

My guess is this small fix will land earlier, if so I'll rebase. :)

Thanks,

-- 
Peter Xu

* Peter Xu (peterx@redhat.com) wrote:
> On Thu, Feb 17, 2022 at 06:04:07PM +0100, Hanna Reitz wrote:
> > migration_incoming_state_destroy() NULLs all objects it frees after they
> > are freed, presumably so that a subsequent call to the same function
> > will not free them again, unless new objects have been created in the
> > meantime.
> > 
> > transport_data is the exception, and it shows exactly this problem: When
> > an incoming migration uses transport_cleanup() and transport_data, and a
> > subsequent incoming migration (e.g. loadvm) occurs that does not, then
> > when this second one is done, it will call transport_cleanup() on the
> > old transport_data again -- which has already been freed.  This is
> > sometimes visible in the iotest 201, though for some reason I can only
> > reproduce it with -m32.
> > 
> > To fix this, call transport_cleanup() only when transport_data is not
> > NULL (otherwise there is nothing to clean up), and set transport_data to
> > NULL when it has been cleaned up (i.e. freed).
> > 
> > (transport_cleanup() is used only by migration/socket.c, where
> > socket_start_incoming_migration_internal() sets both it and
> > transport_data to non-NULL values.)
> > 
> > Signed-off-by: Hanna Reitz <hreitz@redhat.com>
> 
> I had a similar fix here:
> 
> https://lore.kernel.org/qemu-devel/20220216062809.57179-15-peterx@redhat.com/
> 
> Though there it was because I need migration_incoming_transport_cleanup()
> for other purposes, so the fix came along.
> 
> My guess is this small fix will land earlier, if so I'll rebase. :)

Actually it didn't; so since I've pulled a chunk of Peter's series in
anyway I took the one from Peter's series.

Dave

> Thanks,
> 
> -- 
> Peter Xu
> 
> 
-- 
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK