From 44bfe480716ab12d103fa28d06b1b858d71378a9 Mon Sep 17 00:00:00 2001 From: Luiz Capitulino Date: Fri, 28 Oct 2011 17:08:21 +0200 Subject: [PATCH 18/18] Fix segfault on migration completion RH-Author: Luiz Capitulino Message-id: <20111028150821.1fb04bb7@doriath> Patchwork-id: 34730 O-Subject: [PATCH RHEL6.2 qemu-kvm] Fix segfault on migration completion Bugzilla: 669581 RH-Acked-by: Eduardo Habkost RH-Acked-by: Markus Armbruster RH-Acked-by: Juan Quintela Bugzilla: 749806 Upstream-status: Submitted A simple migration reproduces it: 1. Start the source VM with: # qemu [...] -S 2. Start the destination VM with: # qemu -incoming tcp:0:4444 3. In the source VM: (qemu) migrate -d tcp:0:4444 4. The source VM will segfault as soon as migration completes (might not happen in the first try) What is happening here is that qemu_file_put_notify() can end up closing 's->file' (in which case it's also set to NULL). The call stack is rather complex, but Eduardo helped tracking it to: select loop -> migrate_fd_put_notify() -> qemu_file_put_notify() -> buffered_put_buffer() -> migrate_fd_put_ready() -> migrate_fd_completed() -> migrate_fd_cleanup(). To be honest, it's not completely clear to me in which cases 's->file' is not closed (on error maybe)? But I doubt this fix will make anything worse. Reviewed-by: Paolo Bonzini Acked-by: Eduardo Habkost Signed-off-by: Luiz Capitulino --- migration.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) Signed-off-by: Michal Novotny --- migration.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/migration.c b/migration.c index d61188d..0f73a68 100644 --- a/migration.c +++ b/migration.c @@ -330,7 +330,7 @@ void migrate_fd_put_notify(void *opaque) qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL); qemu_file_put_notify(s->file); - if (qemu_file_get_error(s->file)) { + if (s->file && qemu_file_get_error(s->file)) { migrate_fd_error(s); } } -- 1.7.4.4