From 44bfe480716ab12d103fa28d06b1b858d71378a9 Mon Sep 17 00:00:00 2001
From: Luiz Capitulino <lcapitulino@redhat.com>
Date: Fri, 28 Oct 2011 17:08:21 +0200
Subject: [PATCH 18/18] Fix segfault on migration completion
RH-Author: Luiz Capitulino <lcapitulino@redhat.com>
Message-id: <20111028150821.1fb04bb7@doriath>
Patchwork-id: 34730
O-Subject: [PATCH RHEL6.2 qemu-kvm] Fix segfault on migration completion
Bugzilla: 669581
RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
RH-Acked-by: Juan Quintela <quintela@redhat.com>
Bugzilla: 749806
Upstream-status: Submitted
A simple migration reproduces it:
1. Start the source VM with:
# qemu [...] -S
2. Start the destination VM with:
# qemu <source VM cmd-line> -incoming tcp:0:4444
3. In the source VM:
(qemu) migrate -d tcp:0:4444
4. The source VM will segfault as soon as migration completes (might not
happen in the first try)
What is happening here is that qemu_file_put_notify() can end up closing
's->file' (in which case it's also set to NULL). The call stack is rather
complex, but Eduardo helped tracking it to:
select loop -> migrate_fd_put_notify() -> qemu_file_put_notify() ->
buffered_put_buffer() -> migrate_fd_put_ready() ->
migrate_fd_completed() -> migrate_fd_cleanup().
To be honest, it's not completely clear to me in which cases 's->file'
is not closed (on error maybe)? But I doubt this fix will make anything
worse.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
---
migration.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
Signed-off-by: Michal Novotny <minovotn@redhat.com>
---
migration.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/migration.c b/migration.c
index d61188d..0f73a68 100644
--- a/migration.c
+++ b/migration.c
@@ -330,7 +330,7 @@ void migrate_fd_put_notify(void *opaque)
qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
qemu_file_put_notify(s->file);
- if (qemu_file_get_error(s->file)) {
+ if (s->file && qemu_file_get_error(s->file)) {
migrate_fd_error(s);
}
}
--
1.7.4.4