Re: [PATCH 1/3] migration/multifd: fix nullptr access in terminating multifd threads

[Juan Quintela]

cenjiahui <address@hidden> wrote:
> From: Jiahui Cen <address@hidden>
>
> One multifd channel will shutdown all the other multifd's IOChannel when it
> fails to receive an IOChannel. In this senario, if some multifds had not
> received its IOChannel yet, it would try to shutdown its IOChannel which could
> cause nullptr access at qio_channel_shutdown.
>
> Here is the coredump stack:
>     #0  object_get_class (obj=obj@entry=0x0) at qom/object.c:908
>     #1  0x00005563fdbb8f4a in qio_channel_shutdown (ioc=0x0, 
> how=QIO_CHANNEL_SHUTDOWN_BOTH, errp=0x0) at io/channel.c:355
>     #2  0x00005563fd7b4c5f in multifd_recv_terminate_threads (err=<optimized 
> out>) at migration/ram.c:1280
>     #3  0x00005563fd7bc019 in multifd_recv_new_channel 
> (ioc=ioc@entry=0x556400255610, errp=errp@entry=0x7ffec07dce00) at 
> migration/ram.c:1478
>     #4  0x00005563fda82177 in migration_ioc_process_incoming 
> (ioc=ioc@entry=0x556400255610, errp=errp@entry=0x7ffec07dce30) at 
> migration/migration.c:605
>     #5  0x00005563fda8567d in migration_channel_process_incoming 
> (ioc=0x556400255610) at migration/channel.c:44
>     #6  0x00005563fda83ee0 in socket_accept_incoming_migration 
> (listener=0x5563fff6b920, cioc=0x556400255610, opaque=<optimized out>) at 
> migration/socket.c:166
>     #7  0x00005563fdbc25cd in qio_net_listener_channel_func (ioc=<optimized 
> out>, condition=<optimized out>, opaque=<optimized out>) at 
> io/net-listener.c:54
>     #8  0x00007f895b6fe9a9 in g_main_context_dispatch () from 
> /usr/lib64/libglib-2.0.so.0
>     #9  0x00005563fdc18136 in glib_pollfds_poll () at util/main-loop.c:218
>     #10 0x00005563fdc181b5 in os_host_main_loop_wait (timeout=1000000000) at 
> util/main-loop.c:241
>     #11 0x00005563fdc183a2 in main_loop_wait 
> (nonblocking=nonblocking@entry=0) at util/main-loop.c:517
>     #12 0x00005563fd8edb37 in main_loop () at vl.c:1791
>     #13 0x00005563fd74fd45 in main (argc=<optimized out>, argv=<optimized 
> out>, envp=<optimized out>) at vl.c:4473
>
> To fix it up, let's check p->c before calling qio_channel_shutdown.
>
> Signed-off-by: Jiahui Cen <address@hidden>
> Signed-off-by: Ying Fang <address@hidden>

Reviewed-by: Juan Quintela <address@hidden>