mirror of
				https://github.com/qemu/qemu.git
				synced 2025-10-31 12:07:31 +00:00 
			
		
		
		
	 f83df00900
			
		
	
	
		f83df00900
		
	
	
	
	
		
			
			v9fs_walk() utilizes the v9fs_co_run_in_worker({...}) macro to run the
supplied fs driver code block on a background worker thread.
When either the 'Twalk' client request was interrupted or if the client
requested fid for that 'Twalk' request caused a stat error then that
fs driver code block was left by 'break' keyword, with the intention to
return from worker thread back to main thread as well:
    v9fs_co_run_in_worker({
        if (v9fs_request_cancelled(pdu)) {
            err = -EINTR;
            break;
        }
        err = s->ops->lstat(&s->ctx, &dpath, &fidst);
        if (err < 0) {
            err = -errno;
            break;
        }
        ...
    });
However that 'break;' statement also skipped the v9fs_co_run_in_worker()
macro's final and mandatory
    /* re-enter back to qemu thread */
    qemu_coroutine_yield();
call and thus caused the rest of v9fs_walk() to be continued being
executed on the worker thread instead of main thread, eventually
leading to a crash in the transport virtio transport driver.
To fix this issue and to prevent the same error from happening again by
other users of v9fs_co_run_in_worker() in future, auto wrap the supplied
code block into its own
    do { } while (0);
loop inside the 'v9fs_co_run_in_worker' macro definition.
Full discussion and backtrace:
https://lists.gnu.org/archive/html/qemu-devel/2021-08/msg05209.html
https://lists.gnu.org/archive/html/qemu-devel/2021-09/msg00174.html
Fixes: 8d6cb10073
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <E1mLTBg-0002Bh-2D@lizzy.crudebyte.com>
		
	
			
		
			
				
	
	
		
			114 lines
		
	
	
		
			5.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			114 lines
		
	
	
		
			5.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * 9p backend
 | |
|  *
 | |
|  * Copyright IBM, Corp. 2010
 | |
|  *
 | |
|  * Authors:
 | |
|  *  Harsh Prateek Bora <harsh@linux.vnet.ibm.com>
 | |
|  *  Venkateswararao Jujjuri(JV) <jvrao@linux.vnet.ibm.com>
 | |
|  *
 | |
|  * This work is licensed under the terms of the GNU GPL, version 2.  See
 | |
|  * the COPYING file in the top-level directory.
 | |
|  *
 | |
|  */
 | |
| 
 | |
| #ifndef QEMU_9P_COTH_H
 | |
| #define QEMU_9P_COTH_H
 | |
| 
 | |
| #include "qemu/thread.h"
 | |
| #include "qemu/coroutine.h"
 | |
| #include "9p.h"
 | |
| 
 | |
| /**
 | |
|  * we want to use bottom half because we want to make sure the below
 | |
|  * sequence of events.
 | |
|  *
 | |
|  *   1. Yield the coroutine in the QEMU thread.
 | |
|  *   2. Submit the coroutine to a worker thread.
 | |
|  *   3. Enter the coroutine in the worker thread.
 | |
|  * we cannot swap step 1 and 2, because that would imply worker thread
 | |
|  * can enter coroutine while step1 is still running
 | |
|  *
 | |
|  * @b PERFORMANCE @b CONSIDERATIONS: As a rule of thumb, keep in mind
 | |
|  * that hopping between threads adds @b latency! So when handling a
 | |
|  * 9pfs request, avoid calling v9fs_co_run_in_worker() too often, because
 | |
|  * this might otherwise sum up to a significant, huge overall latency for
 | |
|  * providing the response for just a single request. For that reason it
 | |
|  * is highly recommended to fetch all data from fs driver with a single
 | |
|  * fs driver request on a background I/O thread (bottom half) in one rush
 | |
|  * first and then eventually assembling the final response from that data
 | |
|  * on main I/O thread (top half).
 | |
|  */
 | |
| #define v9fs_co_run_in_worker(code_block)                               \
 | |
|     do {                                                                \
 | |
|         QEMUBH *co_bh;                                                  \
 | |
|         co_bh = qemu_bh_new(co_run_in_worker_bh,                        \
 | |
|                             qemu_coroutine_self());                     \
 | |
|         qemu_bh_schedule(co_bh);                                        \
 | |
|         /*                                                              \
 | |
|          * yield in qemu thread and re-enter back                       \
 | |
|          * in worker thread                                             \
 | |
|          */                                                             \
 | |
|         qemu_coroutine_yield();                                         \
 | |
|         qemu_bh_delete(co_bh);                                          \
 | |
|         do {                                                            \
 | |
|             code_block;                                                 \
 | |
|         } while (0);                                                    \
 | |
|         /* re-enter back to qemu thread */                              \
 | |
|         qemu_coroutine_yield();                                         \
 | |
|     } while (0)
 | |
| 
 | |
| void co_run_in_worker_bh(void *);
 | |
| int coroutine_fn v9fs_co_readlink(V9fsPDU *, V9fsPath *, V9fsString *);
 | |
| int coroutine_fn v9fs_co_readdir(V9fsPDU *, V9fsFidState *, struct dirent **);
 | |
| int coroutine_fn v9fs_co_readdir_many(V9fsPDU *, V9fsFidState *,
 | |
|                                       struct V9fsDirEnt **, off_t, int32_t,
 | |
|                                       bool);
 | |
| off_t coroutine_fn v9fs_co_telldir(V9fsPDU *, V9fsFidState *);
 | |
| void coroutine_fn v9fs_co_seekdir(V9fsPDU *, V9fsFidState *, off_t);
 | |
| void coroutine_fn v9fs_co_rewinddir(V9fsPDU *, V9fsFidState *);
 | |
| int coroutine_fn v9fs_co_statfs(V9fsPDU *, V9fsPath *, struct statfs *);
 | |
| int coroutine_fn v9fs_co_lstat(V9fsPDU *, V9fsPath *, struct stat *);
 | |
| int coroutine_fn v9fs_co_chmod(V9fsPDU *, V9fsPath *, mode_t);
 | |
| int coroutine_fn v9fs_co_utimensat(V9fsPDU *, V9fsPath *, struct timespec [2]);
 | |
| int coroutine_fn v9fs_co_chown(V9fsPDU *, V9fsPath *, uid_t, gid_t);
 | |
| int coroutine_fn v9fs_co_truncate(V9fsPDU *, V9fsPath *, off_t);
 | |
| int coroutine_fn v9fs_co_llistxattr(V9fsPDU *, V9fsPath *, void *, size_t);
 | |
| int coroutine_fn v9fs_co_lgetxattr(V9fsPDU *, V9fsPath *,
 | |
|                                    V9fsString *, void *, size_t);
 | |
| int coroutine_fn v9fs_co_mknod(V9fsPDU *, V9fsFidState *, V9fsString *, uid_t,
 | |
|                                gid_t, dev_t, mode_t, struct stat *);
 | |
| int coroutine_fn v9fs_co_mkdir(V9fsPDU *, V9fsFidState *, V9fsString *,
 | |
|                                mode_t, uid_t, gid_t, struct stat *);
 | |
| int coroutine_fn v9fs_co_remove(V9fsPDU *, V9fsPath *);
 | |
| int coroutine_fn v9fs_co_rename(V9fsPDU *, V9fsPath *, V9fsPath *);
 | |
| int coroutine_fn v9fs_co_unlinkat(V9fsPDU *, V9fsPath *, V9fsString *,
 | |
|                                   int flags);
 | |
| int coroutine_fn v9fs_co_renameat(V9fsPDU *, V9fsPath *, V9fsString *,
 | |
|                                   V9fsPath *, V9fsString *);
 | |
| int coroutine_fn v9fs_co_fstat(V9fsPDU *, V9fsFidState *, struct stat *);
 | |
| int coroutine_fn v9fs_co_opendir(V9fsPDU *, V9fsFidState *);
 | |
| int coroutine_fn v9fs_co_open(V9fsPDU *, V9fsFidState *, int);
 | |
| int coroutine_fn v9fs_co_open2(V9fsPDU *, V9fsFidState *, V9fsString *,
 | |
|                                gid_t, int, int, struct stat *);
 | |
| int coroutine_fn v9fs_co_lsetxattr(V9fsPDU *, V9fsPath *, V9fsString *,
 | |
|                                    void *, size_t, int);
 | |
| int coroutine_fn v9fs_co_lremovexattr(V9fsPDU *, V9fsPath *, V9fsString *);
 | |
| int coroutine_fn v9fs_co_closedir(V9fsPDU *, V9fsFidOpenState *);
 | |
| int coroutine_fn v9fs_co_close(V9fsPDU *, V9fsFidOpenState *);
 | |
| int coroutine_fn v9fs_co_fsync(V9fsPDU *, V9fsFidState *, int);
 | |
| int coroutine_fn v9fs_co_symlink(V9fsPDU *, V9fsFidState *, V9fsString *,
 | |
|                                  const char *, gid_t, struct stat *);
 | |
| int coroutine_fn v9fs_co_link(V9fsPDU *, V9fsFidState *,
 | |
|                               V9fsFidState *, V9fsString *);
 | |
| int coroutine_fn v9fs_co_pwritev(V9fsPDU *, V9fsFidState *,
 | |
|                                  struct iovec *, int, int64_t);
 | |
| int coroutine_fn v9fs_co_preadv(V9fsPDU *, V9fsFidState *,
 | |
|                                 struct iovec *, int, int64_t);
 | |
| int coroutine_fn v9fs_co_name_to_path(V9fsPDU *, V9fsPath *,
 | |
|                                       const char *, V9fsPath *);
 | |
| int coroutine_fn v9fs_co_st_gen(V9fsPDU *pdu, V9fsPath *path, mode_t,
 | |
|                                 V9fsStatDotl *v9stat);
 | |
| 
 | |
| #endif
 |