mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

monitor: fix dangling CPU pointer

Browse Source 
If a CPU selected with the "cpu" command is hot-unplugged then "info cpus"
causes QEMU to exit:

(qemu) device_del cpu1
(qemu) info cpus
qemu:qemu_cpu_kick_thread: No such process

This happens because "cpu" stores the pointer to the selected CPU into
the monitor structure. When the CPU is hot-unplugged, we end up with a
dangling pointer. The "info cpus" command then does:

hmp_info_cpus()
 monitor_get_cpu_index()
  mon_get_cpu()
   cpu_synchronize_state() <--- called with dangling pointer

This could cause a QEMU crash as well.

This patch switches the monitor to store the QOM path instead of a
pointer to the current CPU. The path is then resolved when needed.
If the resolution fails, we assume that the CPU was removed and the
path is resetted to the default (ie, path of first_cpu).

Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <150822818243.26242.12993827911736928961.stgit@bahia.lan>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Greg Kurz 2017-10-17 10:16:22 +02:00 committed by Dr. David Alan Gilbert
parent 554a39eb32
commit 751f8cfe2a
1 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
monitor.c
View File

@ -200,7 +200,7 @@ struct Monitor {
ReadLineState *rs; ReadLineState *rs;
MonitorQMP qmp; MonitorQMP qmp;
CPUState *mon_cpu; gchar *mon_cpu_path;
BlockCompletionFunc *password_completion_cb; BlockCompletionFunc *password_completion_cb;
void *password_opaque; void *password_opaque;
mon_cmd_t *cmd_table; mon_cmd_t *cmd_table;
@ -579,6 +579,7 @@ static void monitor_data_init(Monitor *mon)
static void monitor_data_destroy(Monitor *mon) static void monitor_data_destroy(Monitor *mon)
{ {
g_free(mon->mon_cpu_path);
qemu_chr_fe_deinit(&mon->chr, false); qemu_chr_fe_deinit(&mon->chr, false);
if (monitor_is_qmp(mon)) { if (monitor_is_qmp(mon)) {
json_message_parser_destroy(&mon->qmp.parser); json_message_parser_destroy(&mon->qmp.parser);
@ -1047,20 +1048,32 @@ int monitor_set_cpu(int cpu_index)
if (cpu == NULL) { if (cpu == NULL) {
return -1; return -1;
} }
cur_mon->mon_cpu = cpu; g_free(cur_mon->mon_cpu_path);
cur_mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
return 0; return 0;
} }
CPUState *mon_get_cpu(void) CPUState *mon_get_cpu(void)
{ {
if (!cur_mon->mon_cpu) { CPUState *cpu;
if (cur_mon->mon_cpu_path) {
cpu = (CPUState *) object_resolve_path_type(cur_mon->mon_cpu_path,
TYPE_CPU, NULL);
if (!cpu) {
g_free(cur_mon->mon_cpu_path);
cur_mon->mon_cpu_path = NULL;
}
}
if (!cur_mon->mon_cpu_path) {
if (!first_cpu) { if (!first_cpu) {
return NULL; return NULL;
} }
monitor_set_cpu(first_cpu->cpu_index); monitor_set_cpu(first_cpu->cpu_index);
cpu = first_cpu;
} }
cpu_synchronize_state(cur_mon->mon_cpu); cpu_synchronize_state(cpu);
return cur_mon->mon_cpu; return cpu;
} }
CPUArchState *mon_get_cpu_env(void) CPUArchState *mon_get_cpu_env(void)