diff options
| author | Fabiano Rosas <farosas@suse.de> | 2024-09-17 15:58:02 -0300 |
|---|---|---|
| committer | Peter Xu <peterx@redhat.com> | 2024-09-18 14:27:39 -0400 |
| commit | 4ce56229087860805877075ddb29dd44578365a9 (patch) | |
| tree | 71a450828f48ea21f0cc805a3ce8ffdccd2bab7f /migration/migration.c | |
| parent | 90a384d461af79c8948f1150523f868ef4862573 (diff) | |
| download | qemu-4ce56229087860805877075ddb29dd44578365a9.zip qemu-4ce56229087860805877075ddb29dd44578365a9.tar.gz qemu-4ce56229087860805877075ddb29dd44578365a9.tar.bz2 | |
migration/multifd: Fix rb->receivedmap cleanup race
Fix a segmentation fault in multifd when rb->receivedmap is cleared
too early.
After commit 5ef7e26bdb ("migration/multifd: solve zero page causing
multiple page faults"), multifd started using the rb->receivedmap
bitmap, which belongs to ram.c and is initialized and *freed* from the
ram SaveVMHandlers.
Multifd threads are live until migration_incoming_state_destroy(),
which is called after qemu_loadvm_state_cleanup(), leading to a crash
when accessing rb->receivedmap.
process_incoming_migration_co() ...
qemu_loadvm_state() multifd_nocomp_recv()
qemu_loadvm_state_cleanup() ramblock_recv_bitmap_set_offset()
rb->receivedmap = NULL set_bit_atomic(..., rb->receivedmap)
...
migration_incoming_state_destroy()
multifd_recv_cleanup()
multifd_recv_terminate_threads(NULL)
Move the loadvm cleanup into migration_incoming_state_destroy(), after
multifd_recv_cleanup() to ensure multifd threads have already exited
when rb->receivedmap is cleared.
Adjust the postcopy listen thread comment to indicate that we still
want to skip the cpu synchronization.
CC: qemu-stable@nongnu.org
Fixes: 5ef7e26bdb ("migration/multifd: solve zero page causing multiple page faults")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240917185802.15619-3-farosas@suse.de
[peterx: added comment in migration_incoming_state_destroy()]
Signed-off-by: Peter Xu <peterx@redhat.com>
Diffstat (limited to 'migration/migration.c')
| -rw-r--r-- | migration/migration.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/migration/migration.c b/migration/migration.c index 3dea06d..ae2be31 100644 --- a/migration/migration.c +++ b/migration/migration.c @@ -378,6 +378,11 @@ void migration_incoming_state_destroy(void) struct MigrationIncomingState *mis = migration_incoming_get_current(); multifd_recv_cleanup(); + /* + * RAM state cleanup needs to happen after multifd cleanup, because + * multifd threads can use some of its states (receivedmap). + */ + qemu_loadvm_state_cleanup(); if (mis->to_src_file) { /* Tell source that we are done */ |