From nobody Wed Nov 5 13:48:11 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1497036113954967.2525534978305; Fri, 9 Jun 2017 12:21:53 -0700 (PDT) Received: from localhost ([::1]:56136 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dJPTk-000842-Cc for importer@patchew.org; Fri, 09 Jun 2017 15:21:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53164) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dJPS8-0007B6-6a for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dJPS4-0002j3-WC for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:12 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:27282) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dJPS4-0002hD-KT for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:08 -0400 Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v59JK5ZC026877 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 9 Jun 2017 19:20:06 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v59JK4U8012680 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 9 Jun 2017 19:20:05 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v59JK4LJ013912; Fri, 9 Jun 2017 19:20:04 GMT Received: from abi.no.oracle.com (/10.172.144.123) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 09 Jun 2017 12:20:03 -0700 From: Knut Omang To: "Daniel P . Berrange" , Gerd Hoffmann , Paolo Bonzini Date: Fri, 9 Jun 2017 21:19:48 +0200 Message-Id: X-Mailer: git-send-email 2.9.4 In-Reply-To: References: X-Source-IP: aserv0021.oracle.com [141.146.126.233] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] [fuzzy] X-Received-From: 156.151.31.81 Subject: [Qemu-devel] [PATCH 1/2] Add test-listen - a stress test for QEMU socket listen X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Knut Omang , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" There's a potential race condition between multiple bind()'s attempting to bind to the same port, which occasionally allows more than one bind to succeed against the same port. When a subsequent listen() call is made with the same socket only one will succeed. The current QEMU code does however not take this situation into account and the listen will cause the code to break out and fail even when there are actually available ports to use. This test exposes two subtests: /socket/listen-serial /socket/listen-compete The "compete" subtest creates a number of threads and have them all trying = to bind to the same port with a large enough offset input to allow all threads to get it's own port. The "serial" subtest just does the same, except in series in a single thread. The serial version passes, probably in most versions of QEMU. The parallel version exposes the problem in a relatively reliable way, eg. it fails a majority of times, but not with a 100% rate, occasional passes can be seen. Nevertheless this is quite good given that the bug was tricky to reproduce and has been left undetected for a while. The problem seems to be present in all versions of QEMU. The original failure scenario occurred with VNC port allocation in a traditional Xen based build, in different code but with similar functionality. Reported-by: Bhavesh Davda Signed-off-by: Knut Omang Reviewed-by: Yuval Shaia Reviewed-by: Bhavesh Davda Reviewed-by: Girish Moodalbail --- tests/Makefile.include | 2 +- tests/test-listen.c | 135 ++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 137 insertions(+) create mode 100644 tests/test-listen.c diff --git a/tests/Makefile.include b/tests/Makefile.include index f42f3df..a492285 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -127,6 +127,7 @@ check-unit-y +=3D tests/test-bufferiszero$(EXESUF) gcov-files-check-bufferiszero-y =3D util/bufferiszero.c check-unit-y +=3D tests/test-uuid$(EXESUF) check-unit-y +=3D tests/ptimer-test$(EXESUF) +#check-unit-y +=3D tests/test-listen$(EXESUF) gcov-files-ptimer-test-y =3D hw/core/ptimer.c check-unit-y +=3D tests/test-qapi-util$(EXESUF) gcov-files-test-qapi-util-y =3D qapi/qapi-util.c @@ -760,6 +761,7 @@ tests/test-uuid$(EXESUF): tests/test-uuid.o $(test-util= -obj-y) tests/test-arm-mptimer$(EXESUF): tests/test-arm-mptimer.o tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y) tests/numa-test$(EXESUF): tests/numa-test.o +tests/test-listen$(EXESUF): tests/test-listen.o $(test-util-obj-y) =20 tests/migration/stress$(EXESUF): tests/migration/stress.o $(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"L= INK","$(TARGET_DIR)$@") diff --git a/tests/test-listen.c b/tests/test-listen.c new file mode 100644 index 0000000..517b6ed --- /dev/null +++ b/tests/test-listen.c @@ -0,0 +1,135 @@ +/* + * Test parallel port listen configuration with + * dynamic port allocation + */ + +#include "qemu/osdep.h" +#include "libqtest.h" +#include "qemu-common.h" +#include "qemu/thread.h" +#include "qemu/sockets.h" +#include "qapi/error.h" + +#define NAME_LEN 1024 +#define PORT_LEN 16 + +struct thr_info { + QemuThread thread; + int to_port; + int got_port; + int eno; + int fd; + const char *errstr; +}; + +static char hostname[NAME_LEN + 1]; +static char port[PORT_LEN + 1]; + +static void *listener_thread(void *arg) +{ + struct thr_info *thr =3D (struct thr_info *)arg; + SocketAddress addr =3D { + .type =3D SOCKET_ADDRESS_TYPE_INET, + .u =3D { + .inet =3D { + .host =3D hostname, + .port =3D port, + .ipv4 =3D true, + .has_to =3D true, + .to =3D thr->to_port, + }, + }, + }; + Error *err =3D NULL; + int fd; + + fd =3D socket_listen(&addr, &err); + if (fd < 0) { + thr->eno =3D errno; + thr->errstr =3D error_get_pretty(err); + } else { + struct sockaddr_in a; + socklen_t a_len =3D sizeof(a); + g_assert_cmpint(getsockname(fd, (struct sockaddr *)&a, &a_len), = =3D=3D, 0); + thr->got_port =3D ntohs(a.sin_port); + thr->fd =3D fd; + } + return arg; +} + + +static void listen_compete_nthr(bool threaded, int nthreads, + int start_port, int max_offset) +{ + int i; + int failed_listens =3D 0; + size_t alloc_sz =3D sizeof(struct thr_info) * nthreads; + struct thr_info *thr =3D g_malloc(alloc_sz); + int used[max_offset + 1]; + memset(used, 0, sizeof(used)); + g_assert_nonnull(thr); + g_assert_cmpint(gethostname(hostname, NAME_LEN), =3D=3D , 0); + snprintf(port, PORT_LEN, "%d", start_port); + memset(thr, 0, alloc_sz); + + for (i =3D 0; i < nthreads; i++) { + thr[i].to_port =3D start_port + max_offset; + if (threaded) { + qemu_thread_create(&thr[i].thread, "listener", + listener_thread, &thr[i], + QEMU_THREAD_JOINABLE); + } else { + listener_thread(&thr[i]); + } + } + + if (threaded) { + for (i =3D 0; i < nthreads; i++) { + qemu_thread_join(&thr[i].thread); + } + } + for (i =3D 0; i < nthreads; i++) { + if (thr[i].got_port) { + closesocket(thr[i].fd); + } + } + + for (i =3D 0; i < nthreads; i++) { + if (thr[i].eno !=3D 0) { + printf("** Failed to assign a port to thread %d (errno =3D %d)= \n", i, thr[i].eno); + /* This is what we are interested in capturing - + * catch if something unexpected happens: + */ + g_assert(strstr(thr[i].errstr, "Failed to listen on socket") != =3D NULL); + failed_listens++; + } else { + int assigned_port =3D thr[i].got_port; + g_assert_cmpint(assigned_port, <=3D , thr[i].to_port); + g_assert_cmpint(used[assigned_port - start_port], =3D=3D , 0); + } + } + g_assert_cmpint(failed_listens, =3D=3D, 0); + free(thr); +} + + +static void listen_compete(void) +{ + listen_compete_nthr(true, 200, 5920, 300); +} + +static void listen_serial(void) +{ + listen_compete_nthr(false, 200, 6300, 300); +} + + +int main(int argc, char **argv) +{ + g_test_init(&argc, &argv, NULL); + + g_test_add_func("/socket/listen-serial", listen_serial); + g_test_add_func("/socket/listen-compete", listen_compete); + + return g_test_run(); +} --=20 git-series 0.9.1 From nobody Wed Nov 5 13:48:11 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1497036114392641.481389139805; Fri, 9 Jun 2017 12:21:54 -0700 (PDT) Received: from localhost ([::1]:56137 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dJPTk-000847-Ts for importer@patchew.org; Fri, 09 Jun 2017 15:21:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53160) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dJPS8-0007B5-4c for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dJPS4-0002ix-VR for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:12 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:27283) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dJPS4-0002hE-Jy for qemu-devel@nongnu.org; Fri, 09 Jun 2017 15:20:08 -0400 Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v59JK62Z026890 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 9 Jun 2017 19:20:06 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v59JK68Z028706 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 9 Jun 2017 19:20:06 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v59JK56S013929; Fri, 9 Jun 2017 19:20:05 GMT Received: from abi.no.oracle.com (/10.172.144.123) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 09 Jun 2017 12:20:05 -0700 From: Knut Omang To: "Daniel P . Berrange" , Gerd Hoffmann , Paolo Bonzini Date: Fri, 9 Jun 2017 21:19:49 +0200 Message-Id: X-Mailer: git-send-email 2.9.4 In-Reply-To: References: X-Source-IP: userv0021.oracle.com [156.151.31.71] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] [fuzzy] X-Received-From: 156.151.31.81 Subject: [Qemu-devel] [PATCH 2/2] socket: Handle race condition between binds to the same port X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Knut Omang , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" If an offset of ports is specified to the inet_listen_saddr function(), and two or more processes tries to bind from these ports at the same time, occasionally more than one process may be able to bind to the same port. The condition is detected by listen() but too late to avoid a failure. This function is called by socket_listen() and used by all socket listening code in QEMU, so all cases where any form of dynamic port selection is used should be subject to this issue. Add code to close and re-establish the socket when this condition is observed, hiding the race condition from the user. This has been developed and tested by means of the test-listen unit test in the previous commit. Enable the test for make check now that it passes. Signed-off-by: Knut Omang Reviewed-by: Bhavesh Davda Reviewed-by: Yuval Shaia Reviewed-by: Girish Moodalbail --- tests/Makefile.include | 2 +- util/qemu-sockets.c | 106 +++++++++++++++++++++++++++++------------- 2 files changed, 76 insertions(+), 32 deletions(-) diff --git a/tests/Makefile.include b/tests/Makefile.include index a492285..d8f3bde 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -127,7 +127,7 @@ check-unit-y +=3D tests/test-bufferiszero$(EXESUF) gcov-files-check-bufferiszero-y =3D util/bufferiszero.c check-unit-y +=3D tests/test-uuid$(EXESUF) check-unit-y +=3D tests/ptimer-test$(EXESUF) -#check-unit-y +=3D tests/test-listen$(EXESUF) +check-unit-y +=3D tests/test-listen$(EXESUF) gcov-files-ptimer-test-y =3D hw/core/ptimer.c check-unit-y +=3D tests/test-qapi-util$(EXESUF) gcov-files-test-qapi-util-y =3D qapi/qapi-util.c diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c index b39ae74..693c1ed 100644 --- a/util/qemu-sockets.c +++ b/util/qemu-sockets.c @@ -133,6 +133,64 @@ int inet_ai_family_from_address(InetSocketAddress *add= r, return PF_UNSPEC; } =20 +static int create_fast_reuse_socket(struct addrinfo *e, Error **errp) +{ + int slisten =3D qemu_socket(e->ai_family, e->ai_socktype, e->ai_protoc= ol); + if (slisten < 0) { + if (!e->ai_next) { + error_setg_errno(errp, errno, "Failed to create socket"); + } + return -1; + } + + socket_set_fast_reuse(slisten); +#ifdef IPV6_V6ONLY + if (e->ai_family =3D=3D PF_INET6) { + /* listen on both ipv4 and ipv6 */ + const int off =3D 0; + qemu_setsockopt(slisten, IPPROTO_IPV6, IPV6_V6ONLY, &off, + sizeof(off)); + } +#endif + return slisten; +} + +static int try_bind_listen(int *socket, struct addrinfo *e, + int port, Error **errp) +{ + int s =3D *socket; + int ret; + + inet_setport(e, port); + ret =3D bind(s, e->ai_addr, e->ai_addrlen); + if (ret) { + if (errno !=3D EADDRINUSE) { + error_setg_errno(errp, errno, "Failed to bind socket"); + } + return errno; + } + if (listen(s, 1) =3D=3D 0) { + return 0; + } + if (errno =3D=3D EADDRINUSE) { + /* We got to bind the socket to a port but someone else managed + * to bind to the same port and beat us to listen on it! + * Recreate the socket and return EADDRINUSE to preserve the + * expected state by the caller: + */ + closesocket(s); + s =3D create_fast_reuse_socket(e, errp); + if (s < 0) { + return errno; + } + *socket =3D s; + errno =3D EADDRINUSE; + return errno; + } + error_setg_errno(errp, errno, "Failed to listen on socket"); + return errno; +} + static int inet_listen_saddr(InetSocketAddress *saddr, int port_offset, bool update_addr, @@ -143,6 +201,7 @@ static int inet_listen_saddr(InetSocketAddress *saddr, char uaddr[INET6_ADDRSTRLEN+1]; char uport[33]; int slisten, rc, port_min, port_max, p; + int saved_errno =3D 0; Error *err =3D NULL; =20 memset(&ai,0, sizeof(ai)); @@ -194,54 +253,39 @@ static int inet_listen_saddr(InetSocketAddress *saddr, return -1; } =20 - /* create socket + bind */ + /* create socket + bind/listen */ for (e =3D res; e !=3D NULL; e =3D e->ai_next) { getnameinfo((struct sockaddr*)e->ai_addr,e->ai_addrlen, uaddr,INET6_ADDRSTRLEN,uport,32, NI_NUMERICHOST | NI_NUMERICSERV); - slisten =3D qemu_socket(e->ai_family, e->ai_socktype, e->ai_protoc= ol); + + slisten =3D create_fast_reuse_socket(e, &err); if (slisten < 0) { - if (!e->ai_next) { - error_setg_errno(errp, errno, "Failed to create socket"); - } continue; } - - socket_set_fast_reuse(slisten); -#ifdef IPV6_V6ONLY - if (e->ai_family =3D=3D PF_INET6) { - /* listen on both ipv4 and ipv6 */ - const int off =3D 0; - qemu_setsockopt(slisten, IPPROTO_IPV6, IPV6_V6ONLY, &off, - sizeof(off)); - } -#endif - port_min =3D inet_getport(e); port_max =3D saddr->has_to ? saddr->to + port_offset : port_min; for (p =3D port_min; p <=3D port_max; p++) { - inet_setport(e, p); - if (bind(slisten, e->ai_addr, e->ai_addrlen) =3D=3D 0) { - goto listen; - } - if (p =3D=3D port_max) { - if (!e->ai_next) { - error_setg_errno(errp, errno, "Failed to bind socket"); - } + int eno =3D try_bind_listen(&slisten, e, p, &err); + if (!eno) { + goto listen_ok; + } else if (eno !=3D EADDRINUSE) { + goto listen_failed; } } + } + error_setg_errno(errp, errno, "Failed to find available port"); + +listen_failed: + saved_errno =3D errno; + if (slisten >=3D 0) { closesocket(slisten); } freeaddrinfo(res); + errno =3D saved_errno; return -1; =20 -listen: - if (listen(slisten,1) !=3D 0) { - error_setg_errno(errp, errno, "Failed to listen on socket"); - closesocket(slisten); - freeaddrinfo(res); - return -1; - } +listen_ok: if (update_addr) { g_free(saddr->host); saddr->host =3D g_strdup(uaddr); --=20 git-series 0.9.1