[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.1.2 29/45] migration: Fix possible race when shutting down to_
From: |
Michael Tokarev |
Subject: |
[Stable-8.1.2 29/45] migration: Fix possible race when shutting down to_dst_file |
Date: |
Wed, 4 Oct 2023 11:01:50 +0300 |
From: Fabiano Rosas <farosas@suse.de>
It's not safe to call qemu_file_shutdown() on the to_dst_file without
first checking for the file's presence under the lock. The cleanup of
this file happens at postcopy_pause() and migrate_fd_cleanup() which
are not necessarily running in the same thread as migrate_fd_cancel().
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230918172822.19052-5-farosas@suse.de>
(cherry picked from commit 7478fb0df914f0a5ab551ff74b1df62dd250500e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/migration/migration.c b/migration/migration.c
index 517b3e04d2..169e6bdce8 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1246,7 +1246,7 @@ static void migrate_fd_error(MigrationState *s, const
Error *error)
static void migrate_fd_cancel(MigrationState *s)
{
int old_state ;
- QEMUFile *f = migrate_get_current()->to_dst_file;
+
trace_migrate_fd_cancel();
WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
@@ -1272,11 +1272,13 @@ static void migrate_fd_cancel(MigrationState *s)
* If we're unlucky the migration code might be stuck somewhere in a
* send/write while the network has failed and is waiting to timeout;
* if we've got shutdown(2) available then we can force it to quit.
- * The outgoing qemu file gets closed in migrate_fd_cleanup that is
- * called in a bh, so there is no race against this cancel.
*/
- if (s->state == MIGRATION_STATUS_CANCELLING && f) {
- qemu_file_shutdown(f);
+ if (s->state == MIGRATION_STATUS_CANCELLING) {
+ WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
+ if (s->to_dst_file) {
+ qemu_file_shutdown(s->to_dst_file);
+ }
+ }
}
if (s->state == MIGRATION_STATUS_CANCELLING && s->block_inactive) {
Error *local_err = NULL;
@@ -1520,12 +1522,14 @@ void qmp_migrate_pause(Error **errp)
{
MigrationState *ms = migrate_get_current();
MigrationIncomingState *mis = migration_incoming_get_current();
- int ret;
+ int ret = 0;
if (ms->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
/* Source side, during postcopy */
qemu_mutex_lock(&ms->qemu_file_lock);
- ret = qemu_file_shutdown(ms->to_dst_file);
+ if (ms->to_dst_file) {
+ ret = qemu_file_shutdown(ms->to_dst_file);
+ }
qemu_mutex_unlock(&ms->qemu_file_lock);
if (ret) {
error_setg(errp, "Failed to pause source migration");
--
2.39.2
- [Stable-8.1.2 27/45] migration: Fix possible race when setting rp_state.error, (continued)
- [Stable-8.1.2 27/45] migration: Fix possible race when setting rp_state.error, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 19/45] hw/arm/boot: Set SCR_EL3.FGTEn when booting kernel, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 20/45] target/arm: Don't skip MTE checks for LDRT/STRT at EL0, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 21/45] meson.build: Make keyutils independent from keyring, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 23/45] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467], Michael Tokarev, 2023/10/04
- [Stable-8.1.2 18/45] include/exec: Widen tlb_hit/tlb_hit_page(), Michael Tokarev, 2023/10/04
- [Stable-8.1.2 25/45] ui/vnc: fix handling of VNC_FEATURE_XVP, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 26/45] migration: Fix race that dest preempt thread close too early, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 17/45] tests/file-io-error: New test, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 22/45] accel/tcg: mttcg remove false-negative halted assertion, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 29/45] migration: Fix possible race when shutting down to_dst_file,
Michael Tokarev <=
- [Stable-8.1.2 30/45] migration: Remove redundant cleanup of postcopy_qemufile_src, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 28/45] migration: Fix possible races when shutting down the return path, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 31/45] migration: Consolidate return path closing code, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 33/45] migration: Move return path cleanup to main migration thread, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 32/45] migration: Replace the return path retry logic, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 34/45] softmmu: Use async_run_on_cpu in tcg_commit, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 35/45] accel/tcg: Avoid load of icount_decr if unused, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 39/45] accel/tcg: Always set CF_LAST_IO with CF_NOIRQ, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 40/45] accel/tcg: Always require can_do_io, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 43/45] esp: use correct type for esp_dma_enable() in sysbus_esp_gpio_demux(), Michael Tokarev, 2023/10/04