[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 2/4] vhost: prevent double stop of vhost_net device.
From: |
Ilya Maximets |
Subject: |
[Qemu-devel] [PATCH 2/4] vhost: prevent double stop of vhost_net device. |
Date: |
Wed, 30 Mar 2016 18:14:07 +0300 |
There are few control flows in vhost's implementation where
vhost_net_stop() may be re entered several times in a row. This
leads to triggering of assertion while duble freeing of same resources.
For example, if vhost-user socket disconnection occured:
[-------------------------------- cut -----------------------------------]
[guest]# echo -n '0000:00:01.0' > /sys/bus/pci/drivers/virtio-pci/unbind
qemu: Failed to read msg header. Read 0 instead of 12. Original request 11.
qemu: Failed to read msg header. Read 0 instead of 12. Original request 11.
qemu: Failed to read msg header. Read 0 instead of 12. Original request 11.
qemu: Failed to read msg header. Read 0 instead of 12. Original request 11.
qemu: /qemu/memory.c:1852: memory_region_del_eventfd:
Assertion `i != mr->ioeventfd_nb' failed.
Child terminated with signal = 0x6 (SIGABRT)
GDBserver exiting
[-------------------------------- cut -----------------------------------]
[host]# gdb
Breakpoint 1 in virtio_pci_set_host_notifier_internal()
#0 virtio_pci_set_host_notifier_internal
#1 vhost_dev_disable_notifiers
#2 vhost_net_stop_one
#3 vhost_net_stop (address@hidden, ncs=0x1ce89f0, <...>)
#4 virtio_net_vhost_status
#5 virtio_net_set_status
#6 qmp_set_link (<...>, address@hidden, <...>)
#7 net_vhost_user_event (<...>, event=5)
#8 qemu_chr_be_event
#9 tcp_chr_disconnect
#10 tcp_chr_sync_read
#11 qemu_chr_fe_read_all
#12 vhost_user_read
#13 vhost_user_get_vring_base
#14 vhost_virtqueue_stop
#15 vhost_dev_stop
#16 vhost_net_stop_one
#17 vhost_net_stop (address@hidden, ncs=0x1ce89f0, <...>)
#18 virtio_net_vhost_status
#19 virtio_net_set_status
#20 virtio_set_status
<...>
[-------------------------------- cut -----------------------------------]
In example above assertion will fail when control will be brought back
to function at #17 and it will try to free 'eventfd' that was already
freed at call #3.
Fix that by disallowing execution of vhost_net_stop() if we're
already inside of it.
Signed-off-by: Ilya Maximets <address@hidden>
---
hw/net/vhost_net.c | 8 ++++++++
hw/net/virtio-net.c | 1 +
include/hw/virtio/virtio-net.h | 1 +
3 files changed, 10 insertions(+)
diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 55d5456..0996e5d 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -335,8 +335,14 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs,
BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(dev)));
VirtioBusState *vbus = VIRTIO_BUS(qbus);
VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);
+ VirtIONet *n = VIRTIO_NET(dev);
int i, r;
+ if (n->vhost_stopping_in_progress) {
+ return;
+ }
+ n->vhost_stopping_in_progress = 1;
+
for (i = 0; i < total_queues; i++) {
vhost_net_stop_one(get_vhost_net(ncs[i].peer), dev);
put_vhost_net(ncs[i].peer);
@@ -348,6 +354,8 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs,
fflush(stderr);
}
assert(r >= 0);
+
+ n->vhost_stopping_in_progress = 0;
}
void vhost_net_cleanup(struct vhost_net *net)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index e5456ef..9b1539c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -149,6 +149,7 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t
status)
}
n->vhost_started = 1;
+ n->vhost_stopping_in_progress = 0;
r = vhost_net_start(vdev, n->nic->ncs, queues);
if (r < 0) {
error_report("unable to start vhost net: %d: "
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index 0cabdb6..fc07385 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -74,6 +74,7 @@ typedef struct VirtIONet {
uint8_t nouni;
uint8_t nobcast;
uint8_t vhost_started;
+ uint8_t vhost_stopping_in_progress;
struct {
uint32_t in_use;
uint32_t first_multi;
--
2.5.0