All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths
@ 2018-06-21 22:21 Nishanth Aravamudan
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
  0 siblings, 2 replies; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-21 22:21 UTC (permalink / raw)
  To: naravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Fam Zheng, Paolo Bonzini, qemu-block, qemu-devel

laio_init() can fail for a couple of reasons, which will lead to a NULL
pointer dereference in laio_attach_aio_context(), called from
aio_get_linux_aio().

Test case 1:
    Set /proc/sys/fs/max-aio-nr to 0. Start a guest with an aio=native
    disk.

    Result: laio_init() returns NULL due to not being able to allocate
    any AIO contexts. This NULL is assigned to ctx->linux_aio and
    dereferenced in aio_get_linux_aio.

Test case 2:
    Set /proc/sys/fs/max-aio-nr to 128. Start a guest with an aio=native
    disk and one in-use I/O thread.

    Result: laio_init() returns NULL due to not being able to allocate
    additional AIO contexts for the I/O thread. This NULL is assigned to
    ctx->linux_aio and dereferenced in aio_get_linux_aio.

Thanks to Jon Snow, Eric Blake and Kevin Wolf for review comments on v1
and v2.

Nishanth Aravamudan (2):
  linux-aio: properly bubble up errors from initialization
  file-posix: reconfigure aio on iothread start

 block/file-posix.c      | 33 ++++++++++++++++++++++++++++-----
 block/linux-aio.c       | 15 ++++++++++-----
 include/block/aio.h     |  3 +++
 include/block/raw-aio.h |  2 +-
 stubs/linux-aio.c       |  2 +-
 util/async.c            | 16 +++++++++++++---
 6 files changed, 56 insertions(+), 15 deletions(-)

-- 
2.17.1

^ permalink raw reply	[flat|nested] 8+ messages in thread

* [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization
  2018-06-21 22:21 [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths Nishanth Aravamudan
@ 2018-06-21 22:21 ` Nishanth Aravamudan
  2018-06-22  2:21   ` Fam Zheng
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
  1 sibling, 1 reply; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-21 22:21 UTC (permalink / raw)
  To: naravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Fam Zheng, Paolo Bonzini, qemu-block, qemu-devel

laio_init() can fail for a couple of reasons, which will lead to a NULL
pointer dereference in laio_attach_aio_context().

To solve this, add a aio_setup_linux_aio() function which is called
early in raw_open_common. If this fails, propagate the error up. The
signature of aio_get_linux_aio() was not modified, because it seems
preferable to return the actual errno from the possible failing
initialization calls.

Add an assert that aio_get_linux_aio() cannot return NULL.

Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
---
Changes from v2 -> v3 (thanks to Eric Blake and Kevin Wolf for review):

Use a boolean false rather than 0 in assignment to use_linux_aio.
Drop ending '.' from error_report() calls.
Fix typo in commit message (propogates -> propagates).
Move aio_setup_linux_aio call to raw_open_common.

Changes from v1 -> v2 (thanks to Kevin Wolf for review):

Rather than affect virtio-scsi/blk at all, make all the changes internal
to file-posix.c. Thanks to Kevin Wolf for the suggested change.

 block/file-posix.c      | 17 ++++++++++++-----
 block/linux-aio.c       | 15 ++++++++++-----
 include/block/aio.h     |  3 +++
 include/block/raw-aio.h |  2 +-
 stubs/linux-aio.c       |  2 +-
 util/async.c            | 16 +++++++++++++---
 6 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 07bb061fe4..6a1714d4a8 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -545,11 +545,18 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
 
 #ifdef CONFIG_LINUX_AIO
      /* Currently Linux does AIO only for files opened with O_DIRECT */
-    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
-        error_setg(errp, "aio=native was specified, but it requires "
-                         "cache.direct=on, which was not specified.");
-        ret = -EINVAL;
-        goto fail;
+    if (s->use_linux_aio) {
+        if (!(s->open_flags & O_DIRECT)) {
+            error_setg(errp, "aio=native was specified, but it requires "
+                             "cache.direct=on, which was not specified.");
+            ret = -EINVAL;
+            goto fail;
+        }
+        ret = aio_setup_linux_aio(bdrv_get_aio_context(bs));
+        if (ret != 0) {
+            error_setg(errp, "Unable to setup native AIO context.");
+            goto fail;
+        }
     }
 #else
     if (s->use_linux_aio) {
diff --git a/block/linux-aio.c b/block/linux-aio.c
index 88b8d55ec7..4d799f85fe 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -470,28 +470,33 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
                            qemu_laio_poll_cb);
 }
 
-LinuxAioState *laio_init(void)
+int laio_init(LinuxAioState **linux_aio)
 {
+    int rc;
     LinuxAioState *s;
 
     s = g_malloc0(sizeof(*s));
-    if (event_notifier_init(&s->e, false) < 0) {
+    rc = event_notifier_init(&s->e, false);
+    if (rc < 0) {
         goto out_free_state;
     }
 
-    if (io_setup(MAX_EVENTS, &s->ctx) != 0) {
+    rc = io_setup(MAX_EVENTS, &s->ctx);
+    if (rc != 0) {
         goto out_close_efd;
     }
 
     ioq_init(&s->io_q);
 
-    return s;
+    *linux_aio = s;
+    return 0;
 
 out_close_efd:
     event_notifier_cleanup(&s->e);
 out_free_state:
     g_free(s);
-    return NULL;
+    *linux_aio = NULL;
+    return rc;
 }
 
 void laio_cleanup(LinuxAioState *s)
diff --git a/include/block/aio.h b/include/block/aio.h
index ae6f354e6c..8900516ac5 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -381,6 +381,9 @@ GSource *aio_get_g_source(AioContext *ctx);
 /* Return the ThreadPool bound to this AioContext */
 struct ThreadPool *aio_get_thread_pool(AioContext *ctx);
 
+/* Setup the LinuxAioState bound to this AioContext */
+int aio_setup_linux_aio(AioContext *ctx);
+
 /* Return the LinuxAioState bound to this AioContext */
 struct LinuxAioState *aio_get_linux_aio(AioContext *ctx);
 
diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
index 0e717fd475..81b90e5fc6 100644
--- a/include/block/raw-aio.h
+++ b/include/block/raw-aio.h
@@ -43,7 +43,7 @@
 /* linux-aio.c - Linux native implementation */
 #ifdef CONFIG_LINUX_AIO
 typedef struct LinuxAioState LinuxAioState;
-LinuxAioState *laio_init(void);
+int laio_init(LinuxAioState **linux_aio);
 void laio_cleanup(LinuxAioState *s);
 int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
                                 uint64_t offset, QEMUIOVector *qiov, int type);
diff --git a/stubs/linux-aio.c b/stubs/linux-aio.c
index ed47bd443c..88ab927e35 100644
--- a/stubs/linux-aio.c
+++ b/stubs/linux-aio.c
@@ -21,7 +21,7 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
     abort();
 }
 
-LinuxAioState *laio_init(void)
+int laio_init(LinuxAioState **linux_aio)
 {
     abort();
 }
diff --git a/util/async.c b/util/async.c
index 03f62787f2..ae88c931d0 100644
--- a/util/async.c
+++ b/util/async.c
@@ -323,12 +323,22 @@ ThreadPool *aio_get_thread_pool(AioContext *ctx)
 }
 
 #ifdef CONFIG_LINUX_AIO
-LinuxAioState *aio_get_linux_aio(AioContext *ctx)
+int aio_setup_linux_aio(AioContext *ctx)
 {
+    int rc;
+    rc = 0;
     if (!ctx->linux_aio) {
-        ctx->linux_aio = laio_init();
-        laio_attach_aio_context(ctx->linux_aio, ctx);
+        rc = laio_init(&ctx->linux_aio);
+        if (rc == 0) {
+            laio_attach_aio_context(ctx->linux_aio, ctx);
+        }
     }
+    return rc;
+}
+
+LinuxAioState *aio_get_linux_aio(AioContext *ctx)
+{
+    assert(ctx->linux_aio);
     return ctx->linux_aio;
 }
 #endif
-- 
2.17.1

^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start
  2018-06-21 22:21 [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths Nishanth Aravamudan
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
@ 2018-06-21 22:21 ` Nishanth Aravamudan
  2018-06-22  2:25   ` Fam Zheng
  1 sibling, 1 reply; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-21 22:21 UTC (permalink / raw)
  To: naravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Fam Zheng, Paolo Bonzini, qemu-block, qemu-devel

When the AioContext changes, we need to associate a LinuxAioState with
the new AioContext. Use the bdrv_attach_aio_context callback and call
the new aio_setup_linux_aio(), which will allocate a new AioContext if
needed, and return errors on failures. If it fails for any reason,
fallback to threaded AIO with an error message, as the device is already
in-use by the guest.

Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
---
Note this patch didn't exist in v2, but is a result of feedback to that
posting.

 block/file-posix.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/block/file-posix.c b/block/file-posix.c
index 6a1714d4a8..ce24950acf 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1730,6 +1730,21 @@ static BlockAIOCB *raw_aio_flush(BlockDriverState *bs,
     return paio_submit(bs, s->fd, 0, NULL, 0, cb, opaque, QEMU_AIO_FLUSH);
 }
 
+static void raw_aio_attach_aio_context(BlockDriverState *bs,
+                                       AioContext *new_context)
+{
+#ifdef CONFIG_LINUX_AIO
+    BDRVRawState *s = bs->opaque;
+    if (s->use_linux_aio) {
+        if (aio_setup_linux_aio(new_context) != 0) {
+            error_report("Unable to use native AIO, falling back to "
+                         "thread pool");
+            s->use_linux_aio = false;
+        }
+    }
+#endif
+}
+
 static void raw_close(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
@@ -2608,6 +2623,7 @@ BlockDriver bdrv_file = {
     .bdrv_refresh_limits = raw_refresh_limits,
     .bdrv_io_plug = raw_aio_plug,
     .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
 
     .bdrv_truncate = raw_truncate,
     .bdrv_getlength = raw_getlength,
-- 
2.17.1

^ permalink raw reply related	[flat|nested] 8+ messages in thread

* Re: [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
@ 2018-06-22  2:21   ` Fam Zheng
  2018-06-22 17:12     ` Nishanth Aravamudan
  0 siblings, 1 reply; 8+ messages in thread
From: Fam Zheng @ 2018-06-22  2:21 UTC (permalink / raw)
  To: Nishanth Aravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Paolo Bonzini, qemu-block, qemu-devel

On Thu, 06/21 15:21, Nishanth Aravamudan wrote:
> laio_init() can fail for a couple of reasons, which will lead to a NULL
> pointer dereference in laio_attach_aio_context().
> 
> To solve this, add a aio_setup_linux_aio() function which is called
> early in raw_open_common. If this fails, propagate the error up. The
> signature of aio_get_linux_aio() was not modified, because it seems
> preferable to return the actual errno from the possible failing
> initialization calls.
> 
> Add an assert that aio_get_linux_aio() cannot return NULL.
> 
> Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
> ---
> Changes from v2 -> v3 (thanks to Eric Blake and Kevin Wolf for review):
> 
> Use a boolean false rather than 0 in assignment to use_linux_aio.
> Drop ending '.' from error_report() calls.
> Fix typo in commit message (propogates -> propagates).
> Move aio_setup_linux_aio call to raw_open_common.
> 
> Changes from v1 -> v2 (thanks to Kevin Wolf for review):
> 
> Rather than affect virtio-scsi/blk at all, make all the changes internal
> to file-posix.c. Thanks to Kevin Wolf for the suggested change.
> 
>  block/file-posix.c      | 17 ++++++++++++-----
>  block/linux-aio.c       | 15 ++++++++++-----
>  include/block/aio.h     |  3 +++
>  include/block/raw-aio.h |  2 +-
>  stubs/linux-aio.c       |  2 +-
>  util/async.c            | 16 +++++++++++++---
>  6 files changed, 40 insertions(+), 15 deletions(-)
> 
> diff --git a/block/file-posix.c b/block/file-posix.c
> index 07bb061fe4..6a1714d4a8 100644
> --- a/block/file-posix.c
> +++ b/block/file-posix.c
> @@ -545,11 +545,18 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
>  
>  #ifdef CONFIG_LINUX_AIO
>       /* Currently Linux does AIO only for files opened with O_DIRECT */
> -    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
> -        error_setg(errp, "aio=native was specified, but it requires "
> -                         "cache.direct=on, which was not specified.");
> -        ret = -EINVAL;
> -        goto fail;
> +    if (s->use_linux_aio) {
> +        if (!(s->open_flags & O_DIRECT)) {
> +            error_setg(errp, "aio=native was specified, but it requires "
> +                             "cache.direct=on, which was not specified.");
> +            ret = -EINVAL;
> +            goto fail;
> +        }
> +        ret = aio_setup_linux_aio(bdrv_get_aio_context(bs));
> +        if (ret != 0) {
> +            error_setg(errp, "Unable to setup native AIO context.");
> +            goto fail;
> +        }
>      }
>  #else
>      if (s->use_linux_aio) {
> diff --git a/block/linux-aio.c b/block/linux-aio.c
> index 88b8d55ec7..4d799f85fe 100644
> --- a/block/linux-aio.c
> +++ b/block/linux-aio.c
> @@ -470,28 +470,33 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
>                             qemu_laio_poll_cb);
>  }
>  
> -LinuxAioState *laio_init(void)
> +int laio_init(LinuxAioState **linux_aio)
>  {
> +    int rc;
>      LinuxAioState *s;
>  
>      s = g_malloc0(sizeof(*s));
> -    if (event_notifier_init(&s->e, false) < 0) {
> +    rc = event_notifier_init(&s->e, false);
> +    if (rc < 0) {

It would be nice if the error message could distinguish this error...

>          goto out_free_state;
>      }
>  
> -    if (io_setup(MAX_EVENTS, &s->ctx) != 0) {
> +    rc = io_setup(MAX_EVENTS, &s->ctx);
> +    if (rc != 0) {

... from this one. And it also makes sense to propagate the errno back with
error_setg_errno.

To do this, add an "Error **errp" parameter to the function and you can keep the
return type (LinuxAioState *).

>          goto out_close_efd;
>      }
>  
>      ioq_init(&s->io_q);
>  
> -    return s;
> +    *linux_aio = s;
> +    return 0;
>  
>  out_close_efd:
>      event_notifier_cleanup(&s->e);
>  out_free_state:
>      g_free(s);
> -    return NULL;
> +    *linux_aio = NULL;
> +    return rc;
>  }
>  
>  void laio_cleanup(LinuxAioState *s)
> diff --git a/include/block/aio.h b/include/block/aio.h
> index ae6f354e6c..8900516ac5 100644
> --- a/include/block/aio.h
> +++ b/include/block/aio.h
> @@ -381,6 +381,9 @@ GSource *aio_get_g_source(AioContext *ctx);
>  /* Return the ThreadPool bound to this AioContext */
>  struct ThreadPool *aio_get_thread_pool(AioContext *ctx);
>  
> +/* Setup the LinuxAioState bound to this AioContext */
> +int aio_setup_linux_aio(AioContext *ctx);

And this will then need "Error **errp" as well.

> +
>  /* Return the LinuxAioState bound to this AioContext */
>  struct LinuxAioState *aio_get_linux_aio(AioContext *ctx);
>  
> diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
> index 0e717fd475..81b90e5fc6 100644
> --- a/include/block/raw-aio.h
> +++ b/include/block/raw-aio.h
> @@ -43,7 +43,7 @@
>  /* linux-aio.c - Linux native implementation */
>  #ifdef CONFIG_LINUX_AIO
>  typedef struct LinuxAioState LinuxAioState;
> -LinuxAioState *laio_init(void);
> +int laio_init(LinuxAioState **linux_aio);
>  void laio_cleanup(LinuxAioState *s);
>  int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
>                                  uint64_t offset, QEMUIOVector *qiov, int type);
> diff --git a/stubs/linux-aio.c b/stubs/linux-aio.c
> index ed47bd443c..88ab927e35 100644
> --- a/stubs/linux-aio.c
> +++ b/stubs/linux-aio.c
> @@ -21,7 +21,7 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
>      abort();
>  }
>  
> -LinuxAioState *laio_init(void)
> +int laio_init(LinuxAioState **linux_aio)
>  {
>      abort();
>  }
> diff --git a/util/async.c b/util/async.c
> index 03f62787f2..ae88c931d0 100644
> --- a/util/async.c
> +++ b/util/async.c
> @@ -323,12 +323,22 @@ ThreadPool *aio_get_thread_pool(AioContext *ctx)
>  }
>  
>  #ifdef CONFIG_LINUX_AIO
> -LinuxAioState *aio_get_linux_aio(AioContext *ctx)
> +int aio_setup_linux_aio(AioContext *ctx)
>  {
> +    int rc;
> +    rc = 0;
>      if (!ctx->linux_aio) {
> -        ctx->linux_aio = laio_init();
> -        laio_attach_aio_context(ctx->linux_aio, ctx);
> +        rc = laio_init(&ctx->linux_aio);
> +        if (rc == 0) {
> +            laio_attach_aio_context(ctx->linux_aio, ctx);
> +        }
>      }
> +    return rc;
> +}
> +
> +LinuxAioState *aio_get_linux_aio(AioContext *ctx)
> +{
> +    assert(ctx->linux_aio);
>      return ctx->linux_aio;
>  }
>  #endif
> -- 
> 2.17.1
> 

Fam

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
@ 2018-06-22  2:25   ` Fam Zheng
  2018-06-22  9:02     ` Kevin Wolf
  0 siblings, 1 reply; 8+ messages in thread
From: Fam Zheng @ 2018-06-22  2:25 UTC (permalink / raw)
  To: Nishanth Aravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Paolo Bonzini, qemu-block, qemu-devel

On Thu, 06/21 15:21, Nishanth Aravamudan wrote:
> When the AioContext changes, we need to associate a LinuxAioState with
> the new AioContext. Use the bdrv_attach_aio_context callback and call
> the new aio_setup_linux_aio(), which will allocate a new AioContext if
> needed, and return errors on failures. If it fails for any reason,
> fallback to threaded AIO with an error message, as the device is already
> in-use by the guest.
> 
> Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
> ---
> Note this patch didn't exist in v2, but is a result of feedback to that
> posting.

This should be squashed into patch 1, no?

Fam

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start
  2018-06-22  2:25   ` Fam Zheng
@ 2018-06-22  9:02     ` Kevin Wolf
  2018-06-22 17:12       ` Nishanth Aravamudan
  0 siblings, 1 reply; 8+ messages in thread
From: Kevin Wolf @ 2018-06-22  9:02 UTC (permalink / raw)
  To: Fam Zheng
  Cc: Nishanth Aravamudan, Eric Blake, John Snow, Max Reitz,
	Stefan Hajnoczi, Paolo Bonzini, qemu-block, qemu-devel

Am 22.06.2018 um 04:25 hat Fam Zheng geschrieben:
> On Thu, 06/21 15:21, Nishanth Aravamudan wrote:
> > When the AioContext changes, we need to associate a LinuxAioState with
> > the new AioContext. Use the bdrv_attach_aio_context callback and call
> > the new aio_setup_linux_aio(), which will allocate a new AioContext if
> > needed, and return errors on failures. If it fails for any reason,
> > fallback to threaded AIO with an error message, as the device is already
> > in-use by the guest.
> > 
> > Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
> > ---
> > Note this patch didn't exist in v2, but is a result of feedback to that
> > posting.
> 
> This should be squashed into patch 1, no?

Yes, without it, patch 1 is incorrect. Specifically, at least the
assertion in aio_get_linux_aio() won't hold true without it.

Kevin

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization
  2018-06-22  2:21   ` Fam Zheng
@ 2018-06-22 17:12     ` Nishanth Aravamudan
  0 siblings, 0 replies; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-22 17:12 UTC (permalink / raw)
  To: Fam Zheng
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Paolo Bonzini, qemu-block, qemu-devel

On 22.06.2018 [10:21:19 +0800], Fam Zheng wrote:
> On Thu, 06/21 15:21, Nishanth Aravamudan wrote:
> > laio_init() can fail for a couple of reasons, which will lead to a NULL
> > pointer dereference in laio_attach_aio_context().
> > 
> > To solve this, add a aio_setup_linux_aio() function which is called
> > early in raw_open_common. If this fails, propagate the error up. The
> > signature of aio_get_linux_aio() was not modified, because it seems
> > preferable to return the actual errno from the possible failing
> > initialization calls.
> > 
> > Add an assert that aio_get_linux_aio() cannot return NULL.
> > 
> > Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
> > ---
> > Changes from v2 -> v3 (thanks to Eric Blake and Kevin Wolf for review):
> > 
> > Use a boolean false rather than 0 in assignment to use_linux_aio.
> > Drop ending '.' from error_report() calls.
> > Fix typo in commit message (propogates -> propagates).
> > Move aio_setup_linux_aio call to raw_open_common.
> > 
> > Changes from v1 -> v2 (thanks to Kevin Wolf for review):
> > 
> > Rather than affect virtio-scsi/blk at all, make all the changes internal
> > to file-posix.c. Thanks to Kevin Wolf for the suggested change.
> > 
> >  block/file-posix.c      | 17 ++++++++++++-----
> >  block/linux-aio.c       | 15 ++++++++++-----
> >  include/block/aio.h     |  3 +++
> >  include/block/raw-aio.h |  2 +-
> >  stubs/linux-aio.c       |  2 +-
> >  util/async.c            | 16 +++++++++++++---
> >  6 files changed, 40 insertions(+), 15 deletions(-)
> > 
> > diff --git a/block/file-posix.c b/block/file-posix.c
> > index 07bb061fe4..6a1714d4a8 100644
> > --- a/block/file-posix.c
> > +++ b/block/file-posix.c
> > @@ -545,11 +545,18 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
> >  
> >  #ifdef CONFIG_LINUX_AIO
> >       /* Currently Linux does AIO only for files opened with O_DIRECT */
> > -    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
> > -        error_setg(errp, "aio=native was specified, but it requires "
> > -                         "cache.direct=on, which was not specified.");
> > -        ret = -EINVAL;
> > -        goto fail;
> > +    if (s->use_linux_aio) {
> > +        if (!(s->open_flags & O_DIRECT)) {
> > +            error_setg(errp, "aio=native was specified, but it requires "
> > +                             "cache.direct=on, which was not specified.");
> > +            ret = -EINVAL;
> > +            goto fail;
> > +        }
> > +        ret = aio_setup_linux_aio(bdrv_get_aio_context(bs));
> > +        if (ret != 0) {
> > +            error_setg(errp, "Unable to setup native AIO context.");
> > +            goto fail;
> > +        }
> >      }
> >  #else
> >      if (s->use_linux_aio) {
> > diff --git a/block/linux-aio.c b/block/linux-aio.c
> > index 88b8d55ec7..4d799f85fe 100644
> > --- a/block/linux-aio.c
> > +++ b/block/linux-aio.c
> > @@ -470,28 +470,33 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
> >                             qemu_laio_poll_cb);
> >  }
> >  
> > -LinuxAioState *laio_init(void)
> > +int laio_init(LinuxAioState **linux_aio)
> >  {
> > +    int rc;
> >      LinuxAioState *s;
> >  
> >      s = g_malloc0(sizeof(*s));
> > -    if (event_notifier_init(&s->e, false) < 0) {
> > +    rc = event_notifier_init(&s->e, false);
> > +    if (rc < 0) {
> 
> It would be nice if the error message could distinguish this error...
> 
> >          goto out_free_state;
> >      }
> >  
> > -    if (io_setup(MAX_EVENTS, &s->ctx) != 0) {
> > +    rc = io_setup(MAX_EVENTS, &s->ctx);
> > +    if (rc != 0) {
> 
> ... from this one. And it also makes sense to propagate the errno back with
> error_setg_errno.
> 
> To do this, add an "Error **errp" parameter to the function and you
> can keep the return type (LinuxAioState *).

Thank you for this suggestion! I will send out a v4 with this and your
other feedback integrated.

-Nish

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start
  2018-06-22  9:02     ` Kevin Wolf
@ 2018-06-22 17:12       ` Nishanth Aravamudan
  0 siblings, 0 replies; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-22 17:12 UTC (permalink / raw)
  To: Kevin Wolf
  Cc: Fam Zheng, Eric Blake, John Snow, Max Reitz, Stefan Hajnoczi,
	Paolo Bonzini, qemu-block, qemu-devel

On 22.06.2018 [11:02:06 +0200], Kevin Wolf wrote:
> Am 22.06.2018 um 04:25 hat Fam Zheng geschrieben:
> > On Thu, 06/21 15:21, Nishanth Aravamudan wrote:
> > > When the AioContext changes, we need to associate a LinuxAioState with
> > > the new AioContext. Use the bdrv_attach_aio_context callback and call
> > > the new aio_setup_linux_aio(), which will allocate a new AioContext if
> > > needed, and return errors on failures. If it fails for any reason,
> > > fallback to threaded AIO with an error message, as the device is already
> > > in-use by the guest.
> > > 
> > > Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
> > > ---
> > > Note this patch didn't exist in v2, but is a result of feedback to that
> > > posting.
> > 
> > This should be squashed into patch 1, no?
> 
> Yes, without it, patch 1 is incorrect. Specifically, at least the
> assertion in aio_get_linux_aio() won't hold true without it.

Yes, you are right! Sorry about that. I'll send a v4 today.

-Nish

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2018-06-22 17:12 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-21 22:21 [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths Nishanth Aravamudan
2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
2018-06-22  2:21   ` Fam Zheng
2018-06-22 17:12     ` Nishanth Aravamudan
2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
2018-06-22  2:25   ` Fam Zheng
2018-06-22  9:02     ` Kevin Wolf
2018-06-22 17:12       ` Nishanth Aravamudan

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.