mirror of
https://github.com/Motorhead1991/qemu.git
synced 2026-01-06 14:37:42 -07:00
53021ea165
It's possible that the migration thread skip the join() of the rp_thread in
below race and crash on src right at finishing migration:
migration_thread rp_thread
---------------- ---------
migration_completion()
(before rp_thread quits)
from_dst_file=NULL
[thread got scheduled out]
s->rp_state.from_dst_file==NULL
(skip join() of rp_thread)
migrate_fd_cleanup()
qemu_fclose(s->to_dst_file)
yank_unregister_instance()
assert(yank_find_entry()) <------- crash
It could mostly happen with postcopy, but that shouldn't be required, e.g., I
think it could also trigger with MIGRATION_CAPABILITY_RETURN_PATH set.
It's suspected that above race could be the root cause of a recent (but rare)
migration-test break reported by either Dave or PMM:
https://lore.kernel.org/qemu-devel/YPamXAHwan%2FPPXLf@work-vm/
The issue is: from_dst_file is reset in the rp_thread, so if the thread reset
it to NULL fast enough then the migration thread will assume there's no
rp_thread at all.
This could potentially cause more severe issue (e.g. crash) after the yank code.
Fix it by using a boolean to keep "whether we've created rp_thread".
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20210722175841.938739-2-peterx@redhat.com>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
||
|---|---|---|
| .. | ||
| block-dirty-bitmap.c | ||
| block.c | ||
| block.h | ||
| channel.c | ||
| channel.h | ||
| colo-failover.c | ||
| colo.c | ||
| dirtyrate.c | ||
| dirtyrate.h | ||
| exec.c | ||
| exec.h | ||
| fd.c | ||
| fd.h | ||
| global_state.c | ||
| meson.build | ||
| migration.c | ||
| migration.h | ||
| multifd-zlib.c | ||
| multifd-zstd.c | ||
| multifd.c | ||
| multifd.h | ||
| page_cache.c | ||
| page_cache.h | ||
| postcopy-ram.c | ||
| postcopy-ram.h | ||
| qemu-file-channel.c | ||
| qemu-file-channel.h | ||
| qemu-file.c | ||
| qemu-file.h | ||
| ram.c | ||
| ram.h | ||
| rdma.c | ||
| rdma.h | ||
| savevm.c | ||
| savevm.h | ||
| socket.c | ||
| socket.h | ||
| target.c | ||
| tls.c | ||
| tls.h | ||
| trace-events | ||
| trace.h | ||
| vmstate-types.c | ||
| vmstate.c | ||
| xbzrle.c | ||
| xbzrle.h | ||
| yank_functions.c | ||
| yank_functions.h | ||