* [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head @ 2014-06-25 8:38 Michal Privoznik 2014-06-25 13:46 ` [Qemu-devel] [PATCH for 2.1] " Eric Blake 2014-06-26 4:56 ` [Qemu-devel] [PATCH] " Chun Yan Liu 0 siblings, 2 replies; 5+ messages in thread From: Michal Privoznik @ 2014-06-25 8:38 UTC (permalink / raw) To: qemu-devel; +Cc: stefanha When running a libvirt test suite I've noticed the qemu-img is crashing occasionally. Tracing the problem down led me to the following valgrind output: qemu.git $ valgrind -q ./qemu-img create -f qed -obacking_file=/dev/null,backing_fmt=raw qed ==14881== Invalid write of size 8 ==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692) ==14881== by 0x130782: bdrv_img_create (block.c:5531) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' cluster_size=65536 ==14881== Invalid write of size 8 ==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750) ==14881== by 0x130BF3: bdrv_img_create (block.c:5638) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== The problem is apparently in the qemu_opts_append(). Well, if it gets called twice or more. On the first call, when @dst is NULL some initialization is done during which @dst->head list gets initialized. The list is initialized in a way, so that the list tail points at the list head. However, the next time qemu_opts_append() is called for new options to be added, g_realloc() may move @dst at new address making the old list tail point at invalid address. If that's the case we must update the list pointers. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- util/qemu-option.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/util/qemu-option.c b/util/qemu-option.c index 43de3ad..6ad2cf2 100644 --- a/util/qemu-option.c +++ b/util/qemu-option.c @@ -1111,6 +1111,7 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, size_t num_opts, num_dst_opts; QemuOptDesc *desc; bool need_init = false; + bool need_head_update; if (!list) { return dst; @@ -1121,6 +1122,12 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, */ if (!dst) { need_init = true; + need_head_update = true; + } else { + /* Moreover, even if dst is not NULL, the realloc may move it at a + * different address in which case we may get a stale tail pointer + * in dst->head. */ + need_head_update = QTAILQ_EMPTY(&dst->head); } num_opts = count_opts_list(dst); @@ -1131,9 +1138,11 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, if (need_init) { dst->name = NULL; dst->implied_opt_name = NULL; - QTAILQ_INIT(&dst->head); dst->merge_lists = false; } + if (need_head_update) { + QTAILQ_INIT(&dst->head); + } dst->desc[num_dst_opts].name = NULL; /* append list->desc to dst->desc */ -- 1.8.5.5 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH for 2.1] qemu_opts_append: Play nicely with QemuOptsList's head 2014-06-25 8:38 [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head Michal Privoznik @ 2014-06-25 13:46 ` Eric Blake 2014-06-26 13:56 ` Kevin Wolf 2014-06-26 4:56 ` [Qemu-devel] [PATCH] " Chun Yan Liu 1 sibling, 1 reply; 5+ messages in thread From: Eric Blake @ 2014-06-25 13:46 UTC (permalink / raw) To: Michal Privoznik, qemu-devel; +Cc: Chunyan Liu, Stefan Hajnoczi [-- Attachment #1: Type: text/plain, Size: 1525 bytes --] On 06/25/2014 02:38 AM, Michal Privoznik wrote: > When running a libvirt test suite I've noticed the qemu-img is > crashing occasionally. Tracing the problem down led me to the > following valgrind output: Thanks for tracking this! It has been reported in other threads, but yours is the first patch. > The problem is apparently in the qemu_opts_append(). Well, if it > gets called twice or more. On the first call, when @dst is NULL > some initialization is done during which @dst->head list gets > initialized. The list is initialized in a way, so that the list > tail points at the list head. However, the next time > qemu_opts_append() is called for new options to be added, > g_realloc() may move @dst at new address making the old list tail s/at new/to a new/ > point at invalid address. If that's the case we must update the > list pointers. > > Signed-off-by: Michal Privoznik <mprivozn@redhat.com> > --- > util/qemu-option.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) Reviewed-by: Eric Blake <eblake@redhat.com> > + need_head_update = true; > + } else { > + /* Moreover, even if dst is not NULL, the realloc may move it at a s/at/to/ > + * different address in which case we may get a stale tail pointer > + * in dst->head. */ > + need_head_update = QTAILQ_EMPTY(&dst->head); > } > -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 604 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH for 2.1] qemu_opts_append: Play nicely with QemuOptsList's head 2014-06-25 13:46 ` [Qemu-devel] [PATCH for 2.1] " Eric Blake @ 2014-06-26 13:56 ` Kevin Wolf 0 siblings, 0 replies; 5+ messages in thread From: Kevin Wolf @ 2014-06-26 13:56 UTC (permalink / raw) To: Eric Blake; +Cc: Michal Privoznik, qemu-devel, Stefan Hajnoczi, Chunyan Liu [-- Attachment #1: Type: text/plain, Size: 1421 bytes --] Am 25.06.2014 um 15:46 hat Eric Blake geschrieben: > On 06/25/2014 02:38 AM, Michal Privoznik wrote: > > When running a libvirt test suite I've noticed the qemu-img is > > crashing occasionally. Tracing the problem down led me to the > > following valgrind output: > > Thanks for tracking this! It has been reported in other threads, but > yours is the first patch. > > > The problem is apparently in the qemu_opts_append(). Well, if it > > gets called twice or more. On the first call, when @dst is NULL > > some initialization is done during which @dst->head list gets > > initialized. The list is initialized in a way, so that the list > > tail points at the list head. However, the next time > > qemu_opts_append() is called for new options to be added, > > g_realloc() may move @dst at new address making the old list tail > > s/at new/to a new/ > > > point at invalid address. If that's the case we must update the > > list pointers. > > > > Signed-off-by: Michal Privoznik <mprivozn@redhat.com> > > --- > > util/qemu-option.c | 11 ++++++++++- > > 1 file changed, 10 insertions(+), 1 deletion(-) > > Reviewed-by: Eric Blake <eblake@redhat.com> > > > > + need_head_update = true; > > + } else { > > + /* Moreover, even if dst is not NULL, the realloc may move it at a > > s/at/to/ Thanks, fixed the comments and applied to the block branch. Kevin [-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head 2014-06-25 8:38 [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head Michal Privoznik 2014-06-25 13:46 ` [Qemu-devel] [PATCH for 2.1] " Eric Blake @ 2014-06-26 4:56 ` Chun Yan Liu 2014-06-26 6:33 ` Michal Privoznik 1 sibling, 1 reply; 5+ messages in thread From: Chun Yan Liu @ 2014-06-26 4:56 UTC (permalink / raw) To: qemu-devel, Michal Privoznik; +Cc: stefanha >>> On 6/25/2014 at 04:38 PM, in message <9ca16cc7ed58cd133ea2c8d86c29707b54005e1d.1403685480.git.mprivozn@redhat.com>, Michal Privoznik <mprivozn@redhat.com> wrote: > When running a libvirt test suite I've noticed the qemu-img is > crashing occasionally. Tracing the problem down led me to the > following valgrind output: > > qemu.git $ valgrind -q ./qemu-img create -f qed > -obacking_file=/dev/null,backing_fmt=raw qed > ==14881== Invalid write of size 8 > ==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692) > ==14881== by 0x130782: bdrv_img_create (block.c:5531) > ==14881== by 0x118DE0: img_create (qemu-img.c:462) > ==14881== by 0x11E7E4: main (qemu-img.c:2830) > ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd > ==14881== at 0x4C2CA5E: realloc (in > /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) > ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) > ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) > ==14881== by 0x13075E: bdrv_img_create (block.c:5528) > ==14881== by 0x118DE0: img_create (qemu-img.c:462) > ==14881== by 0x11E7E4: main (qemu-img.c:2830) > ==14881== > Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' > cluster_size=65536 > ==14881== Invalid write of size 8 > ==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750) > ==14881== by 0x130BF3: bdrv_img_create (block.c:5638) > ==14881== by 0x118DE0: img_create (qemu-img.c:462) > ==14881== by 0x11E7E4: main (qemu-img.c:2830) > ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd > ==14881== at 0x4C2CA5E: realloc (in > /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) > ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) > ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) > ==14881== by 0x13075E: bdrv_img_create (block.c:5528) > ==14881== by 0x118DE0: img_create (qemu-img.c:462) > ==14881== by 0x11E7E4: main (qemu-img.c:2830) > ==14881== > > The problem is apparently in the qemu_opts_append(). Well, if it > gets called twice or more. On the first call, when @dst is NULL > some initialization is done during which @dst->head list gets > initialized. The list is initialized in a way, so that the list > tail points at the list head. However, the next time > qemu_opts_append() is called for new options to be added, > g_realloc() may move @dst at new address making the old list tail > point at invalid address. If that's the case we must update the > list pointers. > > Signed-off-by: Michal Privoznik <mprivozn@redhat.com> > --- > util/qemu-option.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/util/qemu-option.c b/util/qemu-option.c > index 43de3ad..6ad2cf2 100644 > --- a/util/qemu-option.c > +++ b/util/qemu-option.c > @@ -1111,6 +1111,7 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, > size_t num_opts, num_dst_opts; > QemuOptDesc *desc; > bool need_init = false; > + bool need_head_update; > > if (!list) { > return dst; > @@ -1121,6 +1122,12 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, > */ > if (!dst) { > need_init = true; > + need_head_update = true; Thanks very much for correction. But I think putting need_head_update here is a little odd. How about delete this line and ... [1] > + } else { > + /* Moreover, even if dst is not NULL, the realloc may move it at a > + * different address in which case we may get a stale tail pointer > + * in dst->head. */ Only when dst->head is empty, we need to reinit, if dst->head->tqh_last points to other places already, we should not reinit. How about make it more clear? e.g. If dst->head is empty, then (dst->head)->tqh_last = &(dst->head)->tqh_first; after g_realloc, (dst->head)->tqh_last may point to stail pointer, in this case, need to reinit dst->head. > + need_head_update = QTAILQ_EMPTY(&dst->head); > } > > num_opts = count_opts_list(dst); > @@ -1131,9 +1138,11 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, > if (need_init) { > dst->name = NULL; > dst->implied_opt_name = NULL; > - QTAILQ_INIT(&dst->head); [1] ... this line? (And initialize need_head_update = false.) Thanks, Chunyan > dst->merge_lists = false; > } > + if (need_head_update) { > + QTAILQ_INIT(&dst->head); > + } > dst->desc[num_dst_opts].name = NULL; > > /* append list->desc to dst->desc */ > -- > 1.8.5.5 > > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head 2014-06-26 4:56 ` [Qemu-devel] [PATCH] " Chun Yan Liu @ 2014-06-26 6:33 ` Michal Privoznik 0 siblings, 0 replies; 5+ messages in thread From: Michal Privoznik @ 2014-06-26 6:33 UTC (permalink / raw) To: Chun Yan Liu, qemu-devel; +Cc: stefanha On 26.06.2014 06:56, Chun Yan Liu wrote: > > >>>> On 6/25/2014 at 04:38 PM, in message > <9ca16cc7ed58cd133ea2c8d86c29707b54005e1d.1403685480.git.mprivozn@redhat.com>, > Michal Privoznik <mprivozn@redhat.com> wrote: >> When running a libvirt test suite I've noticed the qemu-img is >> crashing occasionally. Tracing the problem down led me to the >> following valgrind output: >> >> qemu.git $ valgrind -q ./qemu-img create -f qed >> -obacking_file=/dev/null,backing_fmt=raw qed >> ==14881== Invalid write of size 8 >> ==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692) >> ==14881== by 0x130782: bdrv_img_create (block.c:5531) >> ==14881== by 0x118DE0: img_create (qemu-img.c:462) >> ==14881== by 0x11E7E4: main (qemu-img.c:2830) >> ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd >> ==14881== at 0x4C2CA5E: realloc (in >> /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) >> ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) >> ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) >> ==14881== by 0x13075E: bdrv_img_create (block.c:5528) >> ==14881== by 0x118DE0: img_create (qemu-img.c:462) >> ==14881== by 0x11E7E4: main (qemu-img.c:2830) >> ==14881== >> Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' >> cluster_size=65536 >> ==14881== Invalid write of size 8 >> ==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750) >> ==14881== by 0x130BF3: bdrv_img_create (block.c:5638) >> ==14881== by 0x118DE0: img_create (qemu-img.c:462) >> ==14881== by 0x11E7E4: main (qemu-img.c:2830) >> ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd >> ==14881== at 0x4C2CA5E: realloc (in >> /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) >> ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) >> ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) >> ==14881== by 0x13075E: bdrv_img_create (block.c:5528) >> ==14881== by 0x118DE0: img_create (qemu-img.c:462) >> ==14881== by 0x11E7E4: main (qemu-img.c:2830) >> ==14881== >> >> The problem is apparently in the qemu_opts_append(). Well, if it >> gets called twice or more. On the first call, when @dst is NULL >> some initialization is done during which @dst->head list gets >> initialized. The list is initialized in a way, so that the list >> tail points at the list head. However, the next time >> qemu_opts_append() is called for new options to be added, >> g_realloc() may move @dst at new address making the old list tail >> point at invalid address. If that's the case we must update the >> list pointers. >> >> Signed-off-by: Michal Privoznik <mprivozn@redhat.com> >> --- >> util/qemu-option.c | 11 ++++++++++- >> 1 file changed, 10 insertions(+), 1 deletion(-) >> >> diff --git a/util/qemu-option.c b/util/qemu-option.c >> index 43de3ad..6ad2cf2 100644 >> --- a/util/qemu-option.c >> +++ b/util/qemu-option.c >> @@ -1111,6 +1111,7 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, >> size_t num_opts, num_dst_opts; >> QemuOptDesc *desc; >> bool need_init = false; >> + bool need_head_update; >> >> if (!list) { >> return dst; >> @@ -1121,6 +1122,12 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, >> */ >> if (!dst) { >> need_init = true; >> + need_head_update = true; > > Thanks very much for correction. But I think putting need_head_update here > is a little odd. How about delete this line and ... [1] > >> + } else { >> + /* Moreover, even if dst is not NULL, the realloc may move it at a >> + * different address in which case we may get a stale tail pointer >> + * in dst->head. */ > > Only when dst->head is empty, we need to reinit, if dst->head->tqh_last points > to other places already, we should not reinit. How about make it more clear? > e.g. > If dst->head is empty, then (dst->head)->tqh_last = &(dst->head)->tqh_first; after > g_realloc, (dst->head)->tqh_last may point to stail pointer, in this case, need to > reinit dst->head. Sure. But I wanted to avoid naming tqh_last or tqh_first explicitly as we have macros for that. Then, if we ever change the naming in include/qemu/queue.h we need to change this comment too. > >> + need_head_update = QTAILQ_EMPTY(&dst->head); >> } >> >> num_opts = count_opts_list(dst); >> @@ -1131,9 +1138,11 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, >> if (need_init) { >> dst->name = NULL; >> dst->implied_opt_name = NULL; >> - QTAILQ_INIT(&dst->head); > > [1] ... this line? (And initialize need_head_update = false.) Yes, fix can be written in many ways. Then it's just the question of code style preference. Michal ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-06-26 14:15 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-06-25 8:38 [Qemu-devel] [PATCH] qemu_opts_append: Play nicely with QemuOptsList's head Michal Privoznik 2014-06-25 13:46 ` [Qemu-devel] [PATCH for 2.1] " Eric Blake 2014-06-26 13:56 ` Kevin Wolf 2014-06-26 4:56 ` [Qemu-devel] [PATCH] " Chun Yan Liu 2014-06-26 6:33 ` Michal Privoznik
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).