ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

migration/multifd: Fix rb->receivedmap cleanup race 

Fix a segmentation fault in multifd when rb->receivedmap is cleared
too early.

After commit 5ef7e26bdb ("migration/multifd: solve zero page causing
multiple page faults"), multifd started using the rb->receivedmap
bitmap, which belongs to ram.c and is initialized and *freed* from the
ram SaveVMHandlers.

Multifd threads are live until migration_incoming_state_destroy(),
which is called after qemu_loadvm_state_cleanup(), leading to a crash
when accessing rb->receivedmap.

process_incoming_migration_co()        ...
  qemu_loadvm_state()                  multifd_nocomp_recv()
    qemu_loadvm_state_cleanup()          ramblock_recv_bitmap_set_offset()
      rb->receivedmap = NULL               set_bit_atomic(..., rb->receivedmap)
  ...
  migration_incoming_state_destroy()
    multifd_recv_cleanup()
      multifd_recv_terminate_threads(NULL)

Move the loadvm cleanup into migration_incoming_state_destroy(), after
multifd_recv_cleanup() to ensure multifd threads have already exited
when rb->receivedmap is cleared.

Adjust the postcopy listen thread comment to indicate that we still
want to skip the cpu synchronization.

CC: qemu-stable@nongnu.org
Fixes: 5ef7e26bdb ("migration/multifd: solve zero page causing multiple page faults")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240917185802.15619-3-farosas@suse.de
[peterx: added comment in migration_incoming_state_destroy()]
Signed-off-by: Peter Xu <peterx@redhat.com>
This commit is contained in:
Fabiano Rosas 2024-09-17 15:58:02 -03:00 committed by Peter Xu
parent 90a384d461
commit 4ce5622908
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
migration/migration.c
View File

@ -378,6 +378,11 @@ void migration_incoming_state_destroy(void)
struct MigrationIncomingState *mis = migration_incoming_get_current(); struct MigrationIncomingState *mis = migration_incoming_get_current();
multifd_recv_cleanup(); multifd_recv_cleanup();
/*
* RAM state cleanup needs to happen after multifd cleanup, because
* multifd threads can use some of its states (receivedmap).
*/
qemu_loadvm_state_cleanup();
if (mis->to_src_file) { if (mis->to_src_file) {
/* Tell source that we are done */ /* Tell source that we are done */

6
migration/savevm.c
View File

@ -2979,7 +2979,10 @@ int qemu_loadvm_state(QEMUFile *f)
trace_qemu_loadvm_state_post_main(ret); trace_qemu_loadvm_state_post_main(ret);
if (mis->have_listen_thread) { if (mis->have_listen_thread) {
/* Listen thread still going, can't clean up yet */ /*
* Postcopy listen thread still going, don't synchronize the
* cpus yet.
*/
return ret; return ret;
} }
@ -3022,7 +3025,6 @@ int qemu_loadvm_state(QEMUFile *f)
} }
} }
qemu_loadvm_state_cleanup();
cpu_synchronize_all_post_init(); cpu_synchronize_all_post_init();
return ret; return ret;