[PATCH] monitor/qmp: cleanup socket listener sources early to avoid fd handling race

[Jie Song <mail@jiesong.me>]

From: Jie Song <songjie_yewu@cmss.chinamobile.com>

When starting a dummy QEMU process with virsh, monitor_init_qmp() enables
IOThread monitoring of the QMP fd by default. However, a race condition
exists during the initialization phase: the IOThread only removes the
main thread's fd watch when it reaches qio_net_listener_set_client_func_full(),
which may be delayed under high system load.

This creates a window between monitor_qmp_setup_handlers_bh() and
qio_net_listener_set_client_func_full() where both the main thread and
IOThread are simultaneously monitoring the same fd and processing events.
This race can cause either the main thread or the IOThread to hang and
become unresponsive.

Fix this by proactively cleaning up the listener's IO sources in
monitor_init_qmp() before the IOThread initializes QMP monitoring,
ensuring exclusive fd ownership and eliminating the race condition.

The fix introduces socket_chr_listener_cleanup() to destroy and unref
all existing IO sources on the socket chardev listener, guaranteeing
that no concurrent fd monitoring occurs during the transition to
IOThread handling.

Signed-off-by: Jie Song <songjie_yewu@cmss.chinamobile.com>
---
 chardev/char-socket.c         | 18 ++++++++++++++++++
 include/chardev/char-socket.h |  2 ++
 monitor/qmp.c                 |  6 ++++++
 3 files changed, 26 insertions(+)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 62852e3caf..073a9da855 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -656,6 +656,24 @@ static void tcp_chr_telnet_destroy(SocketChardev *s)
     }
 }
 
+void socket_chr_listener_cleanup(Chardev *chr)
+{
+    SocketChardev *s = SOCKET_CHARDEV(chr);
+
+    if (s->listener) {
+        QIONetListener *listener = s->listener;
+        size_t i;
+
+        for (i = 0; i < listener->nsioc; i++) {
+            if (listener->io_source[i]) {
+                g_source_destroy(listener->io_source[i]);
+                g_source_unref(listener->io_source[i]);
+                listener->io_source[i] = NULL;
+            }
+        }
+    }
+}
+
 static void tcp_chr_update_read_handler(Chardev *chr)
 {
     SocketChardev *s = SOCKET_CHARDEV(chr);
diff --git a/include/chardev/char-socket.h b/include/chardev/char-socket.h
index d6d13ad37f..682440c6de 100644
--- a/include/chardev/char-socket.h
+++ b/include/chardev/char-socket.h
@@ -84,4 +84,6 @@ typedef struct SocketChardev SocketChardev;
 DECLARE_INSTANCE_CHECKER(SocketChardev, SOCKET_CHARDEV,
                          TYPE_CHARDEV_SOCKET)
 
+void socket_chr_listener_cleanup(Chardev *chr);
+
 #endif /* CHAR_SOCKET_H */
diff --git a/monitor/qmp.c b/monitor/qmp.c
index cb99a12d94..d9d1fafa70 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -25,6 +25,7 @@
 #include "qemu/osdep.h"
 
 #include "chardev/char-io.h"
+#include "chardev/char-socket.h"
 #include "monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
@@ -537,6 +538,11 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
          * e.g. the chardev is in client mode, with wait=on.
          */
         remove_fd_in_watch(chr);
+        /*
+         * Clean up listener IO sources early to prevent racy fd
+         * handling between the main thread and the I/O thread.
+         */
+        socket_chr_listener_cleanup(chr);
         /*
          * We can't call qemu_chr_fe_set_handlers() directly here
          * since chardev might be running in the monitor I/O
-- 
2.43.0