chardev: Fix issues found by vhost-user-test

[PATCH 0/4] chardev: Fix issues found by vhost-user-test

Fabiano Rosas posted 4 patches 7 months ago

Download series mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20250515222014.4161-1-farosas@suse.de

Maintainers: "Marc-André Lureau" <marcandre.lureau@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>

chardev/char-io.c      |  5 +++++
chardev/char-socket.c  | 38 ++++++++++++--------------------------
chardev/char.c         |  2 ++
include/chardev/char.h |  1 +
4 files changed, 20 insertions(+), 26 deletions(-)

Expand all Fold all

[PATCH 0/4] chardev: Fix issues found by vhost-user-test

Posted by Fabiano Rosas 7 months ago

Running vhost-user-test with ASAN on a loaded machine reveals several
intermittent issues. These show up every time I test the qtest tree so
I'm trying to get rid of them.

1- UAF of IOWatchPoll.
   This one is self explanatory, ASAN caught it.

2- Reference counting issues in glib. It seems it's possible to unref
   a source while adding a callback to it, and glib asserts. This
   shows up on all architectures, only on the ASAN build after
   hundreds of iterations.

3- Extra yank_unregister_function call leads to abort(). This shows up
   on all architectures, but it's quite hidden due to vhost-user-test
   using a dedicated server thread which dies and causes timeouts in
   the test.

   Manifests as assert(s->fds_num) failing. Only on the ASAN build,
   after tens of iterations (quite common).

Thanks

Fabiano Rosas (4):
  chardev: Fix QIOChannel refcount
  chardev: Don't attempt to unregister yank function more than once
  chardev: Consolidate yank registration
  chardev: Introduce a lock for hup_source

 chardev/char-io.c      |  5 +++++
 chardev/char-socket.c  | 38 ++++++++++++--------------------------
 chardev/char.c         |  2 ++
 include/chardev/char.h |  1 +
 4 files changed, 20 insertions(+), 26 deletions(-)

-- 
2.35.3

Re: [PATCH 0/4] chardev: Fix issues found by vhost-user-test

Posted by Marc-André Lureau 6 months, 4 weeks ago

Hi

On Fri, May 16, 2025 at 12:21 AM Fabiano Rosas <farosas@suse.de> wrote:
>
> Running vhost-user-test with ASAN on a loaded machine reveals several
> intermittent issues. These show up every time I test the qtest tree so
> I'm trying to get rid of them.
>
> 1- UAF of IOWatchPoll.
>    This one is self explanatory, ASAN caught it.
>
> 2- Reference counting issues in glib. It seems it's possible to unref
>    a source while adding a callback to it, and glib asserts. This
>    shows up on all architectures, only on the ASAN build after
>    hundreds of iterations.
>
> 3- Extra yank_unregister_function call leads to abort(). This shows up
>    on all architectures, but it's quite hidden due to vhost-user-test
>    using a dedicated server thread which dies and causes timeouts in
>    the test.
>
>    Manifests as assert(s->fds_num) failing. Only on the ASAN build,
>    after tens of iterations (quite common).
>
> Thanks
>
> Fabiano Rosas (4):
>   chardev: Fix QIOChannel refcount
>   chardev: Don't attempt to unregister yank function more than once
>   chardev: Consolidate yank registration
>   chardev: Introduce a lock for hup_source

Daniel, would you take the first 3 (or all) patches in your next I/O PR ?

>
>  chardev/char-io.c      |  5 +++++
>  chardev/char-socket.c  | 38 ++++++++++++--------------------------
>  chardev/char.c         |  2 ++
>  include/chardev/char.h |  1 +
>  4 files changed, 20 insertions(+), 26 deletions(-)
>
> --
> 2.35.3
>
>


-- 
Marc-André Lureau