External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-03 10:25:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mdev: Fix daemon crash on domain shutdown after reconnect

Browse Source 
The problem resides in virHostdevUpdateActiveMediatedDevices which gets
called during qemuProcessReconnect. The issue here is that
virMediatedDeviceListAdd takes a pointer to the item to be added to the
list to which VIR_APPEND_ELEMENT is used, which also clears the pointer.
However, in this case only the local copy of the pointer got cleared,
leaving the original pointing to valid memory. To sum it up, during
cleanup phase, the original pointer is freed and the daemon crashes
basically any time it would access it.

Backtrace:
0x00007ffff3ccdeba in __strcmp_sse2_unaligned
0x00007ffff72a444a in virMediatedDeviceListFindIndex
0x00007ffff7241446 in virHostdevReAttachMediatedDevices
0x00007fffc60215d9 in qemuHostdevReAttachMediatedDevices
0x00007fffc60216dc in qemuHostdevReAttachDomainDevices
0x00007fffc6046e6f in qemuProcessStop
0x00007fffc6091596 in processMonitorEOFEvent
0x00007fffc6091793 in qemuProcessEventHandler
0x00007ffff7294bf5 in virThreadPoolWorker
0x00007ffff7294184 in virThreadHelper
0x00007ffff3fdc3c4 in start_thread () from /lib64/libpthread.so.0
0x00007ffff3d269cf in clone () from /lib64/libc.so.6

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1446455

(cherry picked from commit 92e30a4dace54d06433f763e1acba0a81bb5c82e)
Signed-off-by: Erik Skultety <eskultet@redhat.com>
This commit is contained in:
Erik Skultety 2017-04-28 09:24:31 +02:00
parent 5d4ecee94f
commit 950f1a3956
3 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/util/virhostdev.c
View File

@ -1294,7 +1294,7 @@ virHostdevUpdateActiveMediatedDevices(virHostdevManagerPtr mgr,
virMediatedDeviceSetUsedBy(mdev, drv_name, dom_name);
if (virMediatedDeviceListAdd(mgr->activeMediatedHostdevs, mdev) < 0)
if (virMediatedDeviceListAdd(mgr->activeMediatedHostdevs, &mdev) < 0)
goto cleanup;
}
@ -1790,7 +1790,7 @@ virHostdevPrepareMediatedDevices(virHostdevManagerPtr mgr,
if (!(mdev = virMediatedDeviceNew(src->uuidstr, src->model)))
goto cleanup;
if (virMediatedDeviceListAdd(list, mdev) < 0) {
if (virMediatedDeviceListAdd(list, &mdev) < 0) {
virMediatedDeviceFree(mdev);
goto cleanup;
}

13
src/util/virmdev.c
View File

@ -312,16 +312,19 @@ virMediatedDeviceListDispose(void *obj)
}
/* The reason for @dev to be double pointer is that VIR_APPEND_ELEMENT clears
* the pointer and we need to clear the original not a copy on the stack
*/
int
virMediatedDeviceListAdd(virMediatedDeviceListPtr list,
virMediatedDevicePtr dev)
virMediatedDevicePtr *dev)
{
if (virMediatedDeviceListFind(list, dev)) {
if (virMediatedDeviceListFind(list, *dev)) {
virReportError(VIR_ERR_INTERNAL_ERROR,
_("device %s is already in use"), dev->path);
_("device %s is already in use"), (*dev)->path);
return -1;
}
return VIR_APPEND_ELEMENT(list->devs, list->count, dev);
return VIR_APPEND_ELEMENT(list->devs, list->count, *dev);
}
@ -457,7 +460,7 @@ virMediatedDeviceListMarkDevices(virMediatedDeviceListPtr dst,
* - caller is responsible for NOT freeing devices in @src on success
* - we're responsible for performing a rollback on failure
*/
if (virMediatedDeviceListAdd(dst, mdev) < 0)
if (virMediatedDeviceListAdd(dst, &mdev) < 0)
goto rollback;
VIR_DEBUG("'%s' added to list of active mediated devices used by '%s'",

2
src/util/virmdev.h
View File

@ -86,7 +86,7 @@ virMediatedDeviceListNew(void);
int
virMediatedDeviceListAdd(virMediatedDeviceListPtr list,
virMediatedDevicePtr dev);
virMediatedDevicePtr *dev);
virMediatedDevicePtr
virMediatedDeviceListGet(virMediatedDeviceListPtr list,