Re: [Qemu-devel] [PATCH 2/2] qtest: fix crash if SIGABRT during qtest_init()

[Stefan Hajnoczi]

On Thu, Mar 27, 2014 at 3:02 PM, Markus Armbruster <address@hidden> wrote:
> Stefan Hajnoczi <address@hidden> writes:
>
>> On Thu, Mar 27, 2014 at 2:34 PM, Marcel Apfelbaum <address@hidden> wrote:
>>> On Thu, 2014-03-27 at 14:12 +0100, Andreas Färber wrote:
>>>> Am 27.03.2014 14:09, schrieb Markus Armbruster:
>>>> > Reply after commit, sorry.
>>>> >
>>>> > Stefan Hajnoczi <address@hidden> writes:
>>>> >
>>>> >> If an assertion fails during qtest_init() the SIGABRT handler is
>>>> >> invoked.  This is the correct behavior since we need to kill the QEMU
>>>> >> process to avoid leaking it when the test dies.
>>>> >>
>>>> >> The global_qtest pointer used by the SIGABRT handler is currently only
>>>> >> assigned after qtest_init() returns.  This results in a segfault if an
>>>> >> assertion failure occurs during qtest_init().
>>>> >>
>>>> >> Move global_qtest assignment inside qtest_init().  Not pretty but let's
>>>> >> face it - the signal handler dependeds on global state.
>>>> >>
>>>> >> Reported-by: Marcel Apfelbaum <address@hidden>
>>>> >> Signed-off-by: Stefan Hajnoczi <address@hidden>
>>>> >> ---
>>>> >>  tests/libqtest.c | 3 ++-
>>>> >>  tests/libqtest.h | 4 +---
>>>> >>  2 files changed, 3 insertions(+), 4 deletions(-)
>>>> >>
>>>> >> diff --git a/tests/libqtest.c b/tests/libqtest.c
>>>> >> index c9e78aa..f387662 100644
>>>> >> --- a/tests/libqtest.c
>>>> >> +++ b/tests/libqtest.c
>>>> >> @@ -120,7 +120,7 @@ QTestState *qtest_init(const char *extra_args)
>>>> >>      qemu_binary = getenv("QTEST_QEMU_BINARY");
>>>> >>      g_assert(qemu_binary != NULL);
>>>> >>
>>>> >> -    s = g_malloc(sizeof(*s));
>>>> >> +    global_qtest = s = g_malloc(sizeof(*s));
>>>> >>
>>>> >>      socket_path = g_strdup_printf("/tmp/qtest-%d.sock", getpid());
>>>> >>      qmp_socket_path = g_strdup_printf("/tmp/qtest-%d.qmp", getpid());
>>>> >> @@ -181,6 +181,7 @@ QTestState *qtest_init(const char *extra_args)
>>>> >>  void qtest_quit(QTestState *s)
>>>> >>  {
>>>> >>      sigaction(SIGABRT, &s->sigact_old, NULL);
>>>> >> +    global_qtest = NULL;
>>>> >>
>>>> >>      kill_qemu(s);
>>>> >>      close(s->fd);
>>>> >> diff --git a/tests/libqtest.h b/tests/libqtest.h
>>>> >> index 9deebdc..7e23a4e 100644
>>>> >> --- a/tests/libqtest.h
>>>> >> +++ b/tests/libqtest.h
>>>> >> @@ -335,8 +335,7 @@ void qtest_add_func(const char *str, void (*fn));
>>>> >>   */
>>>> >>  static inline QTestState *qtest_start(const char *args)
>>>> >>  {
>>>> >> -    global_qtest = qtest_init(args);
>>>> >> -    return global_qtest;
>>>> >> +    return qtest_init(args);
>>>> >>  }
>>>> >>
>>>> >>  /**
>>>> >> @@ -347,7 +346,6 @@ static inline QTestState *qtest_start(const char 
>>>> >> *args)
>>>> >>  static inline void qtest_end(void)
>>>> >>  {
>>>> >>      qtest_quit(global_qtest);
>>>> >> -    global_qtest = NULL;
>>>> >>  }
>>>> >>
>>>> >>  /**
>>>> >
>>>> > Before this patch, the libqtest API could theoretically support multiple
>>>> > simultaneous instances of QTestState.  This patch kills that option,
>>>> > doesn't it?
>>>>
>>>> Ouch, I thought I had looked out for that...
>>>>
>>>> >
>>>> > If yes: fine with me, we don't need it anyway.
>>>>
>>>> We do. Migration and ivshmem are examples that need two machines - might
>>>> explain why my ivshmem-test was behaving unexpectedly.
>>>>
>>>> Apart from reverting, what are our options?
>>> The problem is in 'kill_qemu' function, which is called from
>>> SIGABRT signal handler.  The later needs to know the QTestState
>>> in order to kill the QEMU process.
>>>
>>> Without this patch, kill_qemu will cause a segfault because of:
>>> static void kill_qemu(QTestState *s)
>>> {
>>>     if (s->qemu_pid != -1) {
>>> ...
>>> s can be NULL if there is an assert in qtest_init.
>>>
>>> I suppose we can find a different approach, like keeping
>>> the qemu_pid(s) in another statically defined struct.
>>
>> We can keep a global linked list of QEMU pids.
>
> What about a global list of QTestState?

Yes, that's exactly what I ended up implementing.  Sending patch.

Stefan