mirror of https://github.com/proxmox/mirror_qemu
4290b4834c
Incoming enabled bitmaps are busy, because we do bdrv_dirty_bitmap_create_successor() for them. But disabled bitmaps being migrated are not marked busy, and user can remove them during the incoming migration. Then we may crash in cancel_incoming_locked() when try to remove the bitmap that was already removed by user, like this: #0 qemu_mutex_lock_impl (mutex=0x5593d88c50d1, file=0x559680554b20 "../block/dirty-bitmap.c", line=64) at ../util/qemu-thread-posix.c:77 #1 bdrv_dirty_bitmaps_lock (bs=0x5593d88c0ee9) at ../block/dirty-bitmap.c:64 #2 bdrv_release_dirty_bitmap (bitmap=0x5596810e9570) at ../block/dirty-bitmap.c:362 #3 cancel_incoming_locked (s=0x559680be8208 <dbm_state+40>) at ../migration/block-dirty-bitmap.c:918 #4 dirty_bitmap_load (f=0x559681d02b10, opaque=0x559680be81e0 <dbm_state>, version_id=1) at ../migration/block-dirty-bitmap.c:1194 #5 vmstate_load (f=0x559681d02b10, se=0x559680fb5810) at ../migration/savevm.c:908 #6 qemu_loadvm_section_part_end (f=0x559681d02b10, mis=0x559680fb4a30) at ../migration/savevm.c:2473 #7 qemu_loadvm_state_main (f=0x559681d02b10, mis=0x559680fb4a30) at ../migration/savevm.c:2626 #8 postcopy_ram_listen_thread (opaque=0x0) at ../migration/savevm.c:1871 #9 qemu_thread_start (args=0x5596817ccd10) at ../util/qemu-thread-posix.c:521 #10 start_thread () at /lib64/libpthread.so.0 #11 clone () at /lib64/libc.so.6 Note bs pointer taken from bitmap: it's definitely bad aligned. That's because we are in use after free, bitmap is already freed. So, let's make disabled bitmaps (being migrated) busy during incoming migration. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210322094906.5079-2-vsementsov@virtuozzo.com> |
||
|---|---|---|
| .. | ||
| block-dirty-bitmap.c | ||
| block.c | ||
| block.h | ||
| channel.c | ||
| channel.h | ||
| colo-failover.c | ||
| colo.c | ||
| dirtyrate.c | ||
| dirtyrate.h | ||
| exec.c | ||
| exec.h | ||
| fd.c | ||
| fd.h | ||
| global_state.c | ||
| meson.build | ||
| migration.c | ||
| migration.h | ||
| multifd-zlib.c | ||
| multifd-zstd.c | ||
| multifd.c | ||
| multifd.h | ||
| page_cache.c | ||
| page_cache.h | ||
| postcopy-ram.c | ||
| postcopy-ram.h | ||
| qemu-file-channel.c | ||
| qemu-file-channel.h | ||
| qemu-file.c | ||
| qemu-file.h | ||
| ram.c | ||
| ram.h | ||
| rdma.c | ||
| rdma.h | ||
| savevm.c | ||
| savevm.h | ||
| socket.c | ||
| socket.h | ||
| tls.c | ||
| tls.h | ||
| trace-events | ||
| trace.h | ||
| vmstate-types.c | ||
| vmstate.c | ||
| xbzrle.c | ||
| xbzrle.h | ||