[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] migration: NULL transport_data after freeing
From: |
Dr. David Alan Gilbert |
Subject: |
Re: [PATCH] migration: NULL transport_data after freeing |
Date: |
Thu, 17 Feb 2022 17:29:34 +0000 |
User-agent: |
Mutt/2.1.5 (2021-12-30) |
* Hanna Reitz (hreitz@redhat.com) wrote:
> migration_incoming_state_destroy() NULLs all objects it frees after they
> are freed, presumably so that a subsequent call to the same function
> will not free them again, unless new objects have been created in the
> meantime.
>
> transport_data is the exception, and it shows exactly this problem: When
> an incoming migration uses transport_cleanup() and transport_data, and a
> subsequent incoming migration (e.g. loadvm) occurs that does not, then
> when this second one is done, it will call transport_cleanup() on the
> old transport_data again -- which has already been freed. This is
> sometimes visible in the iotest 201, though for some reason I can only
> reproduce it with -m32.
>
> To fix this, call transport_cleanup() only when transport_data is not
> NULL (otherwise there is nothing to clean up), and set transport_data to
> NULL when it has been cleaned up (i.e. freed).
>
> (transport_cleanup() is used only by migration/socket.c, where
> socket_start_incoming_migration_internal() sets both it and
> transport_data to non-NULL values.)
>
> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
That probably deserves a fixes: a59136f
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> ---
> migration/migration.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/migration/migration.c b/migration/migration.c
> index bcc385b94b..cdb2e76d02 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -287,8 +287,9 @@ void migration_incoming_state_destroy(void)
> g_array_free(mis->postcopy_remote_fds, TRUE);
> mis->postcopy_remote_fds = NULL;
> }
> - if (mis->transport_cleanup) {
> + if (mis->transport_cleanup && mis->transport_data) {
> mis->transport_cleanup(mis->transport_data);
> + mis->transport_data = NULL;
> }
>
> qemu_event_reset(&mis->main_thread_load_event);
> --
> 2.34.1
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK