[PATCH v2] monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race

[PATCH v2] monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race

[Jie Song]

From: Jie Song <songjie_yewu@cmss.chinamobile.com>

When starting a dummy QEMU process with virsh version, monitor_init_qmp()
enables IOThread monitoring of the QMP fd by default. However, a race
condition exists during the initialization phase: the IOThread only removes
the main thread's fd watch when it reaches qio_net_listener_set_client_func_full(),
which may be delayed under high system load.

This creates a window between monitor_qmp_setup_handlers_bh() and
qio_net_listener_set_client_func_full() where both the main thread and
IOThread are simultaneously monitoring the same fd and processing events.
This race can cause either the main thread or the IOThread to hang and
become unresponsive.

This fix calls qio_net_listener_set_client_func_full to change the
callback to NULL to destroy and unref all existing IO sources on the
socket chardev listener before the IOThread initializes QMP monitoring,
guaranteeing that no concurrent fd monitoring occurs during the transition
to IOThread handling.

Signed-off-by: Jie Song <songjie_yewu@cmss.chinamobile.com>
---
Changes in v2:
- Add the judgment of chrdev type, suggested by Daniel P . Berrangé
- Use qio_net_listener_set_client_func_full, suggested by Eric Blake
- Link to v1:
  https://lists.nongnu.org/archive/html/qemu-devel/2025-11/msg01621.html
---
 monitor/qmp.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/monitor/qmp.c b/monitor/qmp.c
index cb99a12d94..0f74298ddd 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -25,6 +25,8 @@
 #include "qemu/osdep.h"
 
 #include "chardev/char-io.h"
+#include "chardev/char-socket.h"
+#include "io/net-listener.h"
 #include "monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
@@ -537,6 +539,16 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
          * e.g. the chardev is in client mode, with wait=on.
          */
         remove_fd_in_watch(chr);
+        /*
+         * Clean up SocketChardev listener IO sources early to prevent
+         * racy fd handling between the main thread and the I/O thread.
+         */
+        if (object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_SOCKET)) {
+            SocketChardev *s = SOCKET_CHARDEV(chr);
+            if (s->listener)
+                qio_net_listener_set_client_func_full(s->listener, NULL, NULL,
+                                                      NULL, chr->gcontext);
+        }
         /*
          * We can't call qemu_chr_fe_set_handlers() directly here
          * since chardev might be running in the monitor I/O
-- 
2.43.0