qemu/block-migration-Ensure-we-don-t-crash-during-migrati.patch
Jiabo Feng 6c5e9f07c4 QEMU update to version 6.2.0-90
- i386/cpuid: Move leaf 7 to correct group
- i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F
- i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs
- i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available
- target/i386: Change wrong XFRM value in SGX CPUID leaf
- target/i386: Enable support for XSAVES based features
- target/i386: Add kvm_get_one_msr helper
- hw/block/hd-geometry: Do not override specified bios-chs-trans mainline inclusion commit fd8a68ad6823d33bedeba20a22857867a1c3890e category: bugfix
- linux-user/riscv: Align signal frame to 16 bytes mainline inclusion commit 1eaa63429a9944265c92efdb94c02fabb231f564 category: bugfix
- ipmi:smbus: Add a check around a memcpy mainline inclusion commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
- tests/tcg/linux-test: Fix random hangs in test_socket mainline inclusion commit b9e6074fc5b429b1e956e9c60db7e284a91e0f3d category: bugfix
- qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports Before v2.12, the implementation of serial ports was limited to a value of MAX_SERIAL_PORTS = 4. We now dynamically allocate the data structures for serial ports, so this limit is no longer present, but the documentation for the -serial options still reads:
- target/ppc: Modify the uncorrect value irq to n_IRQ
- block-migration: Ensure we don't crash during migration cleanup
- target/s390x: fix handling of zeroes in vfmin/vfmax mainline inclusion commit 13c59eb09bd6d1fbc13f08b708226421f14a232b category: bugfix
- hw/virtio/virtio-iommu: Enforce power-of-two notify for both MAP and UNMAP mainline inclusion commit 0522be9a0c0094088ccef7aab352c57f483ca250 category: bugfix
- configure: Add missing POSIX-required space mainline inclusion commit 35a7a6fc5624b1df828d82f2dfa74d0e4188b3b2 category: bugfix
- vga: fix incorrect line height in 640x200x2 mode mainline inclusion commit 37e7b86766244b62a406747bb78e049390d0b528 category: bugfix
- hw/ide/core: set ERR_STAT in unsupported command completion
- linux-user/flatload.c: Fix setting of  image_info::end_code mainline inclusion commit 734a659ad264ac080457167e845ffabbaaa66d0e category: bugfix
- load_elf: fix iterator's type for elf file processing
- hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()
- hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()
- hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array
- chardev/char.c: fix "abstract device type" error message
- block/rbd: fix handling of holes in .bdrv_co_block_status
- qga: treat get-guest-fsinfo as "best effort" mainline inclusion commit bbb0151cf2e82489120a15df5e2eb9653312b0ec category: bugfix
- usb/hcd-xhci: check slotid in  xhci_wakeup_endpoint() mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category: bugfix
- hw/display/bcm2835_fb: Fix framebuffer allocation  address mainline inclusion commit 5865d99fe88d8c8fa437c18c6b63fb2a8165634f category: bugfix
- block/parallels: Fix buffer-based write call mainline inclusion commit eba088f91d21d9e42a81bef847173da30c5da961 category: bugfix
- vl: Improve error message for conflicting -incoming and -loadvm
- hw/smbios: Fix OEM strings table option validation

Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
(cherry picked from commit 5d1a5160936dce1757c09050d97d12f42642794b)
2024-03-23 15:28:34 +08:00

68 lines
2.4 KiB
Diff

From 98d4a8d9d5823d7d43ea816208a35372124a749f Mon Sep 17 00:00:00 2001
From: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
Date: Sun, 10 Mar 2024 22:52:08 -0700
Subject: [PATCH] block-migration: Ensure we don't crash during migration
cleanup
We can fail the blk_insert_bs() at init_blk_migration(), leaving the
BlkMigDevState without a dirty_bitmap and BlockDriverState. Account
for the possibly missing elements when doing cleanup.
Fix the following crashes:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555ec83ef in bdrv_release_dirty_bitmap (bitmap=0x0) at ../block/dirty-bitmap.c:359
359 BlockDriverState *bs = bitmap->bs;
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555e971ff in bdrv_op_unblock (bs=0x0, op=BLOCK_OP_TYPE_BACKUP_SOURCE, reason=0x0) at ../block.c:7073
7073 QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230731203338.27581-1-farosas@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f187609f27b261702a17f79d20bf252ee0d4f9cd)
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
---
migration/block.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/migration/block.c b/migration/block.c
index a950977855..391f8169fd 100644
--- a/migration/block.c
+++ b/migration/block.c
@@ -376,7 +376,9 @@ static void unset_dirty_tracking(void)
BlkMigDevState *bmds;
QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
- bdrv_release_dirty_bitmap(bmds->dirty_bitmap);
+ if (bmds->dirty_bitmap) {
+ bdrv_release_dirty_bitmap(bmds->dirty_bitmap);
+ }
}
}
@@ -684,13 +686,18 @@ static int64_t get_remaining_dirty(void)
static void block_migration_cleanup_bmds(void)
{
BlkMigDevState *bmds;
+ BlockDriverState *bs;
AioContext *ctx;
unset_dirty_tracking();
while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
- bdrv_op_unblock_all(blk_bs(bmds->blk), bmds->blocker);
+
+ bs = blk_bs(bmds->blk);
+ if (bs) {
+ bdrv_op_unblock_all(bs,bmds->blocker);
+ }
error_free(bmds->blocker);
/* Save ctx, because bmds->blk can disappear during blk_unref. */
--
2.27.0