[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_pos
From: |
Dr. David Alan Gilbert |
Subject: |
Re: [Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_postcopy_handle_run_bh |
Date: |
Wed, 9 Mar 2016 18:54:16 +0000 |
User-agent: |
Mutt/1.5.24 (2015-08-30) |
* Denis V. Lunev (address@hidden) wrote:
> MigrationState is destroyed before we can come into bottom half.
>
> Signed-off-by: Denis V. Lunev <address@hidden>
> CC: Juan Quintela <address@hidden>
> CC: Amit Shah <address@hidden>
> CC: Dr. David Alan Gilbert <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
(I was about to post a similar fix; although I'd used
a static QEMUBH * in loadvm_postcopy_handle_run)
This one does work (and I checked the binary actually is the
version I'm running!)
> ---
> Dave, do you have tests you have mention available on public? I'd better
> run them in advance next time.
Not yet; I've got two test sets that both need cleaning up:
1) Is a test harness that boots a full vm, runs a heavy stress test etc
- I can clean that up and put it somewhere; but it has a rather hacky
set of waits for login prompts etc but my intention is
to write a qemu test script in the next month or two.
2) I've got a very hacky autotest/virt-test world that is good
at finding races (it runs no load and has a random delay as to when the
postcopy phase starts); unfortunately virt-test is deprecated
and I've not had time to look at it's replacement yet (avocado);
but my intention is to do that.
I tend to run both of them in a loop - 2 in particular is really good
at finding race conditions such as what happens if the listen thread finishes
at just the same time as something else.
Dave
>
> migration/savevm.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/migration/savevm.c b/migration/savevm.c
> index 96e7db5..384e872 100644
> --- a/migration/savevm.c
> +++ b/migration/savevm.c
> @@ -1501,10 +1501,15 @@ static int
> loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
> return 0;
> }
>
> +
> +typedef struct {
> + QEMUBH *bh;
> +} HandleRunBhData;
> +
> static void loadvm_postcopy_handle_run_bh(void *opaque)
> {
> Error *local_err = NULL;
> - MigrationIncomingState *mis = opaque;
> + HandleRunBhData *data = opaque;
>
> /* TODO we should move all of this lot into postcopy_ram.c or a shared
> code
> * in migration.c
> @@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void
> *opaque)
> runstate_set(RUN_STATE_PAUSED);
> }
>
> - qemu_bh_delete(mis->bh);
> + qemu_bh_delete(data->bh);
> + g_free(data);
> }
>
> /* After all discards we can start running and asking for pages */
> static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
> {
> PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
> + HandleRunBhData *data;
>
> trace_loadvm_postcopy_handle_run();
> if (ps != POSTCOPY_INCOMING_LISTENING) {
> @@ -1546,8 +1553,9 @@ static int
> loadvm_postcopy_handle_run(MigrationIncomingState *mis)
> return -1;
> }
>
> - mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL);
> - qemu_bh_schedule(mis->bh);
> + data = g_new(HandleRunBhData, 1);
> + data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
> + qemu_bh_schedule(data->bh);
>
> /* We need to finish reading the stream from the package
> * and also stop reading anything more from the stream that loaded the
> --
> 2.1.4
>
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK