system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-11-05 20:35:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

nbd: make nbd_export_close_all() synchronous

Browse source 
Consider nbd_export_close_all(). The call-stack looks like this:
 nbd_export_close_all() -> nbd_export_close -> call client_close() for
each client.

client_close() doesn't guarantee that client is closed: nbd_trip()
keeps reference to it. So, nbd_export_close_all() just reduce
reference counter on export and removes it from the list, but doesn't
guarantee that nbd_trip() finished neither export actually removed.

Let's wait for all exports actually removed.

Without this fix, the following crash is possible:

- export bitmap through internal Qemu NBD server
- connect a client
- shutdown Qemu

On shutdown nbd_export_close_all is called, but it actually don't wait
for nbd_trip() to finish and to release its references. So, export is
not release, and exported bitmap remains busy, and on try to remove the
bitmap (which is part of bdrv_close()) the assertion fails:

bdrv_release_dirty_bitmap_locked: Assertion `!bdrv_dirty_bitmap_busy(bitmap)' failed

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200714162234.13113-2-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2020-07-14 19:22:33 +03:00 committed by Kevin Wolf
parent f21f12936f
commit 453cc6be0a
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
nbd/server.c
View file

@ -102,6 +102,8 @@ struct NBDExport {
};
static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
static QTAILQ_HEAD(, NBDExport) closed_exports =
QTAILQ_HEAD_INITIALIZER(closed_exports);
/* NBDExportMetaContexts represents a list of contexts to be exported,
* as selected by NBD_OPT_SET_META_CONTEXT. Also used for
@ -1659,6 +1661,7 @@ void nbd_export_close(NBDExport *exp)
g_free(exp->name);
exp->name = NULL;
QTAILQ_REMOVE(&exports, exp, next);
QTAILQ_INSERT_TAIL(&closed_exports, exp, next);
}
g_free(exp->description);
exp->description = NULL;
@ -1722,7 +1725,9 @@ void nbd_export_put(NBDExport *exp)
g_free(exp->export_bitmap_context);
}
QTAILQ_REMOVE(&closed_exports, exp, next);
g_free(exp);
aio_wait_kick();
}
}
@ -1742,6 +1747,9 @@ void nbd_export_close_all(void)
nbd_export_close(exp);
aio_context_release(aio_context);
}
AIO_WAIT_WHILE(NULL, !(QTAILQ_EMPTY(&exports) &&
QTAILQ_EMPTY(&closed_exports)));
}
static int coroutine_fn nbd_co_send_iov(NBDClient *client, struct iovec *iov,