63 lines
3.1 KiB
Diff
63 lines
3.1 KiB
Diff
|
From 6a08ee257a95d9f2514bd995e90ddf46d3f78b41 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Zheng Chuan <zhengchuan@huawei.com>
|
||
|
|
Date: Tue, 21 Apr 2020 19:49:26 +0800
|
||
|
|
Subject: [PATCH 10/10] migration/multifd: fix nullptr access in
|
||
|
|
multifd_send_terminate_threads
|
||
|
|
|
||
|
|
If the multifd_send_threads is not created when migration is failed,
|
||
|
|
multifd_save_cleanup would be called twice. In this senario, the
|
||
|
|
multifd_send_state is accessed after it has been released, the result
|
||
|
|
is that the source VM is crashing down.
|
||
|
|
|
||
|
|
Here is the coredump stack:
|
||
|
|
Program received signal SIGSEGV, Segmentation fault.
|
||
|
|
0x00005629333a78ef in multifd_send_terminate_threads (err=err@entry=0x0) at migration/ram.c:1012
|
||
|
|
1012 MultiFDSendParams *p = &multifd_send_state->params[i];
|
||
|
|
#0 0x00005629333a78ef in multifd_send_terminate_threads (err=err@entry=0x0) at migration/ram.c:1012
|
||
|
|
#1 0x00005629333ab8a9 in multifd_save_cleanup () at migration/ram.c:1028
|
||
|
|
#2 0x00005629333abaea in multifd_new_send_channel_async (task=0x562935450e70, opaque=<optimized out>) at migration/ram.c:1202
|
||
|
|
#3 0x000056293373a562 in qio_task_complete (task=task@entry=0x562935450e70) at io/task.c:196
|
||
|
|
#4 0x000056293373a6e0 in qio_task_thread_result (opaque=0x562935450e70) at io/task.c:111
|
||
|
|
#5 0x00007f475d4d75a7 in g_idle_dispatch () from /usr/lib64/libglib-2.0.so.0
|
||
|
|
#6 0x00007f475d4da9a9 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
|
||
|
|
#7 0x0000562933785b33 in glib_pollfds_poll () at util/main-loop.c:219
|
||
|
|
#8 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
|
||
|
|
#9 main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:518
|
||
|
|
#10 0x00005629334c5acf in main_loop () at vl.c:1810
|
||
|
|
#11 0x000056293334d7bb in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4471
|
||
|
|
|
||
|
|
If the multifd_send_threads is not created when migration is failed.
|
||
|
|
In this senario, we don't call multifd_save_cleanup in multifd_new_send_channel_async.
|
||
|
|
|
||
|
|
Change-Id: I7441efe2ed542054ecd2a4da8146e2652824b452
|
||
|
|
Signed-off-by: Zhimin Feng <fengzhimin1@huawei.com>
|
||
|
|
Reviewed-by: Juan Quintela <quintela@redhat.com>
|
||
|
|
Signed-off-by: Juan Quintela <quintela@redhat.com>
|
||
|
|
---
|
||
|
|
migration/ram.c | 10 +++++++++-
|
||
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/migration/ram.c b/migration/ram.c
|
||
|
|
index d7d2d5ec..1858d66c 100644
|
||
|
|
--- a/migration/ram.c
|
||
|
|
+++ b/migration/ram.c
|
||
|
|
@@ -1205,7 +1205,15 @@ static void multifd_new_send_channel_async(QIOTask *task, gpointer opaque)
|
||
|
|
|
||
|
|
if (qio_task_propagate_error(task, &local_err)) {
|
||
|
|
migrate_set_error(migrate_get_current(), local_err);
|
||
|
|
- multifd_save_cleanup();
|
||
|
|
+ /* Error happen, we need to tell who pay attention to me */
|
||
|
|
+ qemu_sem_post(&multifd_send_state->channels_ready);
|
||
|
|
+ qemu_sem_post(&p->sem_sync);
|
||
|
|
+ /*
|
||
|
|
+ * Although multifd_send_thread is not created, but main migration
|
||
|
|
+ * thread neet to judge whether it is running, so we need to mark
|
||
|
|
+ * its status.
|
||
|
|
+ */
|
||
|
|
+ p->quit = true;
|
||
|
|
} else {
|
||
|
|
p->c = QIO_CHANNEL(sioc);
|
||
|
|
qio_channel_set_delay(p->c, false);
|
||
|
|
--
|
||
|
|
2.19.1
|