[PATCH] vhost-user-blk: Fix live migration crash during event handling

[Yajun Wu]

After live migration with virtio block device, qemu crash at:

        #0 0x00007fe051e54269 in g_source_destroy () at 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
        #1 0x000055cebaa5f37d in qio_net_listener_set_client_func_full 
(listener=0x55cebceab340, func=0x55cebab4f5f2 <tcp_chr_accept>, 
data=0x55cebcdfcc00, notify=0x0, context=0x0) at ../io/net-listener.c:157
        #2 0x000055cebab4ea99 in tcp_chr_update_read_handler 
(chr=0x55cebcdfcc00) at ../chardev/char-socket.c:639
        #3 0x000055cebab529fa in qemu_chr_be_update_read_handlers 
(s=0x55cebcdfcc00, context=0x0) at ../chardev/char.c:226
        #4 0x000055cebab4a04e in qemu_chr_fe_set_handlers_full 
(b=0x55cebdf52120, fd_can_read=0x0, fd_read=0x0, fd_event=0x0, be_change=0x0, 
opaque=0x0, context=0x0, set_open=false, sync_state=true) at 
../chardev/char-fe.c:279
        #5 0x000055cebab4a0f6 in qemu_chr_fe_set_handlers(b=0x55cebdf52120, 
fd_can_read=0x0, fd_read=0x0, fd_event=0x0, be_change=0x0, opaque=0x0, 
context=0x0, set_open=false) at ../chardev/char-fe.c:304
        #6 0x000055ceba8ec3c8 in vhost_user_blk_event (opaque=0x55cebdf51f40, 
event=CHR_EVENT_CLOSED) at ../hw/block/vhost-user-blk.c:412
        #7 0x000055cebab524a1 in chr_be_event (s=0x55cebcdfcc00, 
event=CHR_EVENT_CLOSED) at ../chardev/char.c:61
        #8 0x000055cebab52519 in qemu_chr_be_event (s=0x55cebcdfcc00, 
event=CHR_EVENT_CLOSED) at ../chardev/char.c:81
        #9 0x000055cebab4fce4 in char_socket_finalize (obj=0x55cebcdfcc00) at 
../chardev/char-socket.c:1085
        #10 0x000055cebaa4cde5 in object_deinit (obj=0x55cebcdfcc00, 
type=0x55cebcc67160) at ../qom/object.c:675
        #11 0x000055cebaa4ce5b in object_finalize (data=0x55cebcdfcc00) at 
../qom/object.c:689
        #12 0x000055cebaa4dcec in object_unref (objptr=0x55cebcdfcc00) at 
../qom/object.c:1192
        #13 0x000055cebaa4f3ee in object_finalize_child_property 
(obj=0x55cebcc6df40, name=0x55cebcead490 "char0", opaque=0x55cebcdfcc00) at 
../qom/object.c:1735
        #14 0x000055cebaa4cbe4 in object_property_del_all (obj=0x55cebcc6df40) 
at ../qom/object.c:627
        #15 0x000055cebaa4ce48 in object_finalize (data=0x55cebcc6df40) at 
../qom/object.c:688
        #16 0x000055cebaa4dcec in object_unref (objptr=0x55cebcc6df40) at 
../qom/object.c:1192
        #17 0x000055cebaa4f3ee in object_finalize_child_property 
(obj=0x55cebce96e00, name=0x55cebceab300 "chardevs", opaque=0x55cebcc6df40) at 
../qom/object.c:1735
        #18 0x000055cebaa4ccd1 in object_property_del_child 
(obj=0x55cebce96e00, child=0x55cebcc6df40) at ../qom/object.c:649
        #19 0x000055cebaa4cdb0 in object_unparent (obj=0x55cebcc6df40) at 
../qom/object.c:668
        #20 0x000055cebab55124 in qemu_chr_cleanup () at ../chardev/char.c:1222
        #21 0x000055ceba79a561 in qemu_cleanup () at ../softmmu/runstate.c:823
        #22 0x000055ceba53d65f in qemu_main (argc=78, argv=0x7ffc9440bd98, 
envp=0x0) at ../softmmu/main.c:37
        #23 0x000055ceba53d68f in main (argc=78, argv=0x7ffc9440bd98) at 
../softmmu/main.c:45

Function qemu_chr_fe_set_handlers should not be called in qemu_chr_cleanup,
because chardev already freed. Quick fix is to handle RUN_STATE_POSTMIGRATE
same as RUN_STATE_SHUTDOWN.

Better solution is to add block device cleanup function like net_cleanup and
call it in qemu_cleanup.

Signed-off-by: Yajun Wu <yajunw@nvidia.com>
Acked-by: Parav Pandit <parav@nvidia.com>
---
 hw/block/vhost-user-blk.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 0d5190accf..b323d5820b 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -110,7 +110,7 @@ static int vhost_user_blk_handle_config_change(struct 
vhost_dev *dev)
     }
 
     /* valid for resize only */
-    if (blkcfg.capacity != s->blkcfg.capacity) {
+    if (s && blkcfg.capacity != s->blkcfg.capacity) {
         s->blkcfg.capacity = blkcfg.capacity;
         memcpy(dev->vdev->config, &s->blkcfg, vdev->config_len);
         virtio_notify_config(dev->vdev);
@@ -398,7 +398,8 @@ static void vhost_user_blk_event(void *opaque, QEMUChrEvent 
event)
         }
         break;
     case CHR_EVENT_CLOSED:
-        if (!runstate_check(RUN_STATE_SHUTDOWN)) {
+        if (!runstate_check(RUN_STATE_SHUTDOWN) &&
+            !runstate_check(RUN_STATE_POSTMIGRATE)) {
             /*
              * A close event may happen during a read/write, but vhost
              * code assumes the vhost_dev remains setup, so delay the
-- 
2.27.0