From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:44907)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1RKl9g-0000GK-3R
	for qemu-devel@nongnu.org; Mon, 31 Oct 2011 02:15:33 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1RKl9f-0008GY-3Q
	for qemu-devel@nongnu.org; Mon, 31 Oct 2011 02:15:31 -0400
Received: from mx1.redhat.com ([209.132.183.28]:58433)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1RKl9e-0008GE-Q6
	for qemu-devel@nongnu.org; Mon, 31 Oct 2011 02:15:31 -0400
Received: from int-mx02.intmail.prod.int.phx2.redhat.com
	(int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p9V6FRp6001727
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <qemu-devel@nongnu.org>; Mon, 31 Oct 2011 02:15:27 -0400
From: Markus Armbruster <armbru@redhat.com>
References: <20111028145952.4bb63294@doriath>
Date: Mon, 31 Oct 2011 07:15:25 +0100
In-Reply-To: <20111028145952.4bb63294@doriath> (Luiz Capitulino's message of
	"Fri, 28 Oct 2011 14:59:52 -0200")
Message-ID: <m339e9ofeq.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: Re: [Qemu-devel] [PATCH v2] Fix segfault on migration completion
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>, Juan Jose Quintela Carreira <quintela@redhat.com>, qemu-devel <qemu-devel@nongnu.org>, Eduardo Habkost <ehabkost@redhat.com>

Luiz Capitulino <lcapitulino@redhat.com> writes:

> A simple migration reproduces it:
>
> 1. Start the source VM with:
>
>    # qemu [...] -S
>
> 2. Start the destination VM with:
>
>    # qemu <source VM cmd-line> -incoming tcp:0:4444
>
> 3. In the source VM:
>
>    (qemu) migrate -d tcp:0:4444
>
> 4. The source VM will segfault as soon as migration completes (might not
>    happen in the first try)
>
> What is happening here is that qemu_file_put_notify() can end up closing
> 's->file' (in which case it's also set to NULL). The call stack is rather
> complex, but Eduardo helped tracking it to:
>
> select loop -> migrate_fd_put_notify() -> qemu_file_put_notify() ->
> buffered_put_buffer() -> migrate_fd_put_ready() ->
> migrate_fd_completed() -> migrate_fd_cleanup().
>
> To be honest, it's not completely clear to me in which cases 's->file'
> is not closed (on error maybe)? But I doubt this fix will make anything
> worse.
>
> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
> Acked-by: Eduardo Habkost <ehabkost@redhat.com>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> ---
>
> V2: better commit log
>
>  migration.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/migration.c b/migration.c
> index bdca72e..f6e6208 100644
> --- a/migration.c
> +++ b/migration.c
> @@ -252,7 +252,7 @@ static void migrate_fd_put_notify(void *opaque)
>  
>      qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
>      qemu_file_put_notify(s->file);
> -    if (qemu_file_get_error(s->file)) {
> +    if (s->file && qemu_file_get_error(s->file)) {
>          migrate_fd_error(s);
>      }
>  }

I wonder whether we can lose the error in s->file by closing s->file
before we get here.  But even if we can, we still report more errors
than before the series this patch fixes.