Re: [Qemu-stable] [PATCH] 9pfs: don't try to flush self and avoid QEMU hang on reset

[Eric Blake]

On 03/16/2017 11:33 AM, Greg Kurz wrote:
> According to the 9P spec [*], when a client wants to cancel a pending I/O
> request identified by a given tag (uint16), it must send a Tflush message
> and wait for the server to respond with a Rflush message before reusing this
> tag for another I/O. The server may still send a completion message for the
> I/O if it wasn't actually cancelled but the Rflush message must arrive after
> that.
> 
> QEMU hence waits for the flushed PDU to complete before sending the Rflush
> message back to the client.
> 
> If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then
> allocate a PDU identified by tag, find it in the PDU list and wait for
> this same PDU to complete... i.e. wait for a completion that will never
> happen. This causes a tag and ring slot leak in the guest, and a PDU
> leak in QEMU, all of them limited by the maximal number of PDUs (128).
> But, worse, this causes QEMU to hang on device reset since v9fs_reset()
> wants to drain all pending I/O.
> 
> This insane behavior is likely to denote a bug in the client, and it would
> deserve an Rerror message to be sent back. Unfortunately, the protocol
> allows it and requires all flush requests to suceed (only a Tflush response

s/suceed/succeed/

> is expected).
> 
> The only option is to detect when we have to handle a self-referencing
> flush request and report success to the client right away.
> 
> [*] http://man.cat-v.org/plan_9/5/flush
> 
> Reported-by: Al Viro <address@hidden>
> Signed-off-by: Greg Kurz <address@hidden>
> ---
>  hw/9pfs/9p.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: Eric Blake <address@hidden>

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature