vhost-user-blk: Fix live migration crash during event handling

Commit Message

Yajun Wu Dec. 7, 2022, 10:20 a.m. UTC

After live migration with virtio block device, qemu crash at:

	#0 0x00007fe051e54269 in g_source_destroy () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
	#1 0x000055cebaa5f37d in qio_net_listener_set_client_func_full (listener=0x55cebceab340, func=0x55cebab4f5f2 <tcp_chr_accept>, data=0x55cebcdfcc00, notify=0x0, context=0x0) at ../io/net-listener.c:157
	#2 0x000055cebab4ea99 in tcp_chr_update_read_handler (chr=0x55cebcdfcc00) at ../chardev/char-socket.c:639
	#3 0x000055cebab529fa in qemu_chr_be_update_read_handlers (s=0x55cebcdfcc00, context=0x0) at ../chardev/char.c:226
	#4 0x000055cebab4a04e in qemu_chr_fe_set_handlers_full (b=0x55cebdf52120, fd_can_read=0x0, fd_read=0x0, fd_event=0x0, be_change=0x0, opaque=0x0, context=0x0, set_open=false, sync_state=true) at ../chardev/char-fe.c:279
	#5 0x000055cebab4a0f6 in qemu_chr_fe_set_handlers(b=0x55cebdf52120, fd_can_read=0x0, fd_read=0x0, fd_event=0x0, be_change=0x0, opaque=0x0, context=0x0, set_open=false) at ../chardev/char-fe.c:304
	#6 0x000055ceba8ec3c8 in vhost_user_blk_event (opaque=0x55cebdf51f40, event=CHR_EVENT_CLOSED) at ../hw/block/vhost-user-blk.c:412
	#7 0x000055cebab524a1 in chr_be_event (s=0x55cebcdfcc00, event=CHR_EVENT_CLOSED) at ../chardev/char.c:61
	#8 0x000055cebab52519 in qemu_chr_be_event (s=0x55cebcdfcc00, event=CHR_EVENT_CLOSED) at ../chardev/char.c:81
	#9 0x000055cebab4fce4 in char_socket_finalize (obj=0x55cebcdfcc00) at ../chardev/char-socket.c:1085
	#10 0x000055cebaa4cde5 in object_deinit (obj=0x55cebcdfcc00, type=0x55cebcc67160) at ../qom/object.c:675
	#11 0x000055cebaa4ce5b in object_finalize (data=0x55cebcdfcc00) at ../qom/object.c:689
	#12 0x000055cebaa4dcec in object_unref (objptr=0x55cebcdfcc00) at ../qom/object.c:1192
	#13 0x000055cebaa4f3ee in object_finalize_child_property (obj=0x55cebcc6df40, name=0x55cebcead490 "char0", opaque=0x55cebcdfcc00) at ../qom/object.c:1735
	#14 0x000055cebaa4cbe4 in object_property_del_all (obj=0x55cebcc6df40) at ../qom/object.c:627
	#15 0x000055cebaa4ce48 in object_finalize (data=0x55cebcc6df40) at ../qom/object.c:688
	#16 0x000055cebaa4dcec in object_unref (objptr=0x55cebcc6df40) at ../qom/object.c:1192
	#17 0x000055cebaa4f3ee in object_finalize_child_property (obj=0x55cebce96e00, name=0x55cebceab300 "chardevs", opaque=0x55cebcc6df40) at ../qom/object.c:1735
	#18 0x000055cebaa4ccd1 in object_property_del_child (obj=0x55cebce96e00, child=0x55cebcc6df40) at ../qom/object.c:649
	#19 0x000055cebaa4cdb0 in object_unparent (obj=0x55cebcc6df40) at ../qom/object.c:668
	#20 0x000055cebab55124 in qemu_chr_cleanup () at ../chardev/char.c:1222
	#21 0x000055ceba79a561 in qemu_cleanup () at ../softmmu/runstate.c:823
	#22 0x000055ceba53d65f in qemu_main (argc=78, argv=0x7ffc9440bd98, envp=0x0) at ../softmmu/main.c:37
	#23 0x000055ceba53d68f in main (argc=78, argv=0x7ffc9440bd98) at ../softmmu/main.c:45

Function qemu_chr_fe_set_handlers should not be called in qemu_chr_cleanup,
because chardev already freed. Quick fix is to handle RUN_STATE_POSTMIGRATE
same as RUN_STATE_SHUTDOWN.

Better solution is to add block device cleanup function like net_cleanup and
call it in qemu_cleanup.

Signed-off-by: Yajun Wu <[e-mail]>
Acked-by: Parav Pandit <[e-mail]>
---
 hw/block/vhost-user-blk.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Patch

diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 0d5190accf..b323d5820b 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -110,7 +110,7 @@  static int vhost_user_blk_handle_config_change(struct vhost_dev *dev)
     }
 
     /* valid for resize only */
-    if (blkcfg.capacity != s->blkcfg.capacity) {
+    if (s && blkcfg.capacity != s->blkcfg.capacity) {
         s->blkcfg.capacity = blkcfg.capacity;
         memcpy(dev->vdev->config, &s->blkcfg, vdev->config_len);
         virtio_notify_config(dev->vdev);
@@ -398,7 +398,8 @@  static void vhost_user_blk_event(void *opaque, QEMUChrEvent event)
         }
         break;
     case CHR_EVENT_CLOSED:
-        if (!runstate_check(RUN_STATE_SHUTDOWN)) {
+        if (!runstate_check(RUN_STATE_SHUTDOWN) &&
+            !runstate_check(RUN_STATE_POSTMIGRATE)) {
             /*
              * A close event may happen during a read/write, but vhost
              * code assumes the vhost_dev remains setup, so delay the