[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v3 3/7] curl: avoid recursive locking of BDRVCURLSta
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PATCH v3 3/7] curl: avoid recursive locking of BDRVCURLState mutex |
Date: |
Mon, 15 May 2017 12:00:55 +0200 |
The curl driver has a ugly hack where, if it cannot find an empty CURLState,
it just uses aio_poll to wait for one to be empty. This is probably
buggy when used together with dataplane, and the simplest way to fix it
is to use coroutines instead.
A more immediate effect of the bug however is that it can cause a
recursive call to curl_readv_bh_cb and recursively taking the
BDRVCURLState mutex. This causes a deadlock.
The fix is to unlock the mutex around aio_poll, but for cleanliness we
should also take the mutex around all calls to curl_init_state, even if
reaching the unlock/lock pair is impossible. The same is true for
curl_clean_state.
Reported-by: Kun Wei <address@hidden>
Tested-by: Richard W.M. Jones <address@hidden>
Cc: address@hidden
Cc: Jeff Cody <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
v2->v3: add missing qemu_mutex_destroy on failure case
block/curl.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/block/curl.c b/block/curl.c
index 924c2a2088..5e6ddf3a34 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -281,6 +281,7 @@ read_end:
return size * nmemb;
}
+/* Called with s->mutex held. */
static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
CURLAIOCB *acb)
{
@@ -453,6 +454,7 @@ static void curl_multi_timeout_do(void *arg)
#endif
}
+/* Called with s->mutex held. */
static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
{
CURLState *state = NULL;
@@ -471,7 +473,9 @@ static CURLState *curl_init_state(BlockDriverState *bs,
BDRVCURLState *s)
break;
}
if (!state) {
+ qemu_mutex_unlock(&s->mutex);
aio_poll(bdrv_get_aio_context(bs), true);
+ qemu_mutex_lock(&s->mutex);
}
} while(!state);
@@ -534,6 +538,7 @@ static CURLState *curl_init_state(BlockDriverState *bs,
BDRVCURLState *s)
return state;
}
+/* Called with s->mutex held. */
static void curl_clean_state(CURLState *s)
{
int j;
@@ -565,6 +570,7 @@ static void curl_detach_aio_context(BlockDriverState *bs)
BDRVCURLState *s = bs->opaque;
int i;
+ qemu_mutex_lock(&s->mutex);
for (i = 0; i < CURL_NUM_STATES; i++) {
if (s->states[i].in_use) {
curl_clean_state(&s->states[i]);
@@ -580,6 +586,7 @@ static void curl_detach_aio_context(BlockDriverState *bs)
curl_multi_cleanup(s->multi);
s->multi = NULL;
}
+ qemu_mutex_unlock(&s->mutex);
timer_del(&s->timer);
}
@@ -677,6 +684,7 @@ static int curl_open(BlockDriverState *bs, QDict *options,
int flags,
return -EROFS;
}
+ qemu_mutex_init(&s->mutex);
opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
qemu_opts_absorb_qdict(opts, options, &local_err);
if (local_err) {
@@ -747,7 +755,9 @@ static int curl_open(BlockDriverState *bs, QDict *options,
int flags,
DPRINTF("CURL: Opening %s\n", file);
s->aio_context = bdrv_get_aio_context(bs);
s->url = g_strdup(file);
+ qemu_mutex_lock(&s->mutex);
state = curl_init_state(bs, s);
+ qemu_mutex_unlock(&s->mutex);
if (!state)
goto out_noclean;
@@ -791,11 +801,12 @@ static int curl_open(BlockDriverState *bs, QDict
*options, int flags,
}
DPRINTF("CURL: Size = %zd\n", s->len);
+ qemu_mutex_lock(&s->mutex);
curl_clean_state(state);
+ qemu_mutex_unlock(&s->mutex);
curl_easy_cleanup(state->curl);
state->curl = NULL;
- qemu_mutex_init(&s->mutex);
curl_attach_aio_context(bs, bdrv_get_aio_context(bs));
qemu_opts_del(opts);
@@ -806,6 +817,7 @@ out:
curl_easy_cleanup(state->curl);
state->curl = NULL;
out_noclean:
+ qemu_mutex_destroy(&s->mutex);
g_free(s->cookie);
g_free(s->url);
qemu_opts_del(opts);
--
2.12.2
- [Qemu-devel] [PATCH v3 0/7] curl: locking cleanups/fixes, coroutine conversion, remove aio_poll, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 1/7] curl: strengthen assertion in curl_clean_state, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 4/7] curl: split curl_find_state/curl_init_state, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 2/7] curl: never invoke callbacks with s->mutex held, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 5/7] curl: convert CURLAIOCB to byte values, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 3/7] curl: avoid recursive locking of BDRVCURLState mutex,
Paolo Bonzini <=
- [Qemu-devel] [PATCH v3 6/7] curl: convert readv to coroutines, Paolo Bonzini, 2017/05/15
- [Qemu-devel] [PATCH v3 7/7] curl: do not do aio_poll when waiting for a free CURLState, Paolo Bonzini, 2017/05/15
- Re: [Qemu-devel] [PATCH v3 0/7] curl: locking cleanups/fixes, coroutine conversion, remove aio_poll, no-reply, 2017/05/15
- Re: [Qemu-devel] [Qemu-block] [PATCH v3 0/7] curl: locking cleanups/fixes, coroutine conversion, remove aio_poll, Max Reitz, 2017/05/15
- Re: [Qemu-devel] [PATCH v3 0/7] curl: locking cleanups/fixes, coroutine conversion, remove aio_poll, Jeff Cody, 2017/05/16
- Re: [Qemu-devel] [PATCH v3 0/7] curl: locking cleanups/fixes, coroutine conversion, remove aio_poll, Richard W.M. Jones, 2017/05/18