spice/server/main_dispatcher.c
Yonit Halperin 8490f83e1f decouple disconnection of the main channel from client destruction
Fixes rhbz#918169

Some channels make direct calls to reds/main_channel routines. If
these routines try to read/write to the socket, and they get socket
error, main_channel_client_on_disconnect is called, and triggers
red_client_destroy. In order to prevent accessing expired references
to RedClient, RedChannelClient, or other objects (inside the original call, after
red_client_destroy has been called) I made the call to
red_client_destroy asynchronous with respect to main_channel_client_on_disconnect.
I added MAIN_DISPATCHER_CLIENT_DISCONNECT to main_dispatcher.
main_channel_client_on_disconnect pushes this msg to the dispatcher,
instead of calling directly to reds_client_disconnect.

The patch uses RedClient ref-count in order to handle a case where
reds_client_disconnect is called directly (e.g., when a new client connects while
another one is connected), while there is already CLIENT_DISCONNECT msg
pending in the main_dispatcher.

Examples:
(1) snd_worker.c

    snd_disconnect_channel()
        channel->cleanup() //snd_playback_cleanup
            reds_enable_mm_timer()
                .
                .
                main_channel_push_multi_media_time()...socket_error
                    .
                    .
                    red_client_destory()
                        .
                        .
                        snd_disconnect_channel()
                            channel->cleanup()
                                celt051_encoder_destroy()
            celt051_encoder_destory() // double release

Note that this bug could have been solved by changing the order of
calls: e.g., channel->stream = NULL before calling cleanup, and
some other changes + reference counting. However, I found other
places in the code with similar problems, and I looked for a general
solution, at least till we redesign red_channel to handle reference
counting more consistently.

(2) inputs_channel.c

    inputs_connect()
        main_channel_client_push_notify()...socket_error
                .
                .
            red_client_destory()
                .
                .
        red_channel_client_create() // refers to client which is already destroyed

(3) reds.c

    reds_handle_main_link()
       main_channel_push_init() ...socket error
                .
                .
            red_client_destory()
                .
                .
       main_channel_client_start_net_test(mcc) // refers to mcc which is already destroyed

    This can explain the assert in rhbz#964136, comment #1 (but not the hang that occurred before).
2013-07-29 11:35:17 -04:00

201 lines
6.8 KiB
C

#include <config.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <pthread.h>
#include "red_common.h"
#include "dispatcher.h"
#include "main_dispatcher.h"
#include "red_channel.h"
#include "reds.h"
/*
* Main Dispatcher
* ===============
*
* Communication channel between any non main thread and the main thread.
*
* The main thread is that from which spice_server_init is called.
*
* Messages are single sized, sent from the non-main thread to the main-thread.
* No acknowledge is sent back. This prevents a possible deadlock with the main
* thread already waiting on a response for the existing red_dispatcher used
* by the worker thread.
*
* All events have three functions:
* main_dispatcher_<event_name> - non static, public function
* main_dispatcher_self_<event_name> - handler for main thread
* main_dispatcher_handle_<event_name> - handler for callback from main thread
* seperate from self because it may send an ack or do other work in the future.
*/
typedef struct {
Dispatcher base;
SpiceCoreInterface *core;
} MainDispatcher;
MainDispatcher main_dispatcher;
enum {
MAIN_DISPATCHER_CHANNEL_EVENT = 0,
MAIN_DISPATCHER_MIGRATE_SEAMLESS_DST_COMPLETE,
MAIN_DISPATCHER_SET_MM_TIME_LATENCY,
MAIN_DISPATCHER_CLIENT_DISCONNECT,
MAIN_DISPATCHER_NUM_MESSAGES
};
typedef struct MainDispatcherChannelEventMessage {
int event;
SpiceChannelEventInfo *info;
} MainDispatcherChannelEventMessage;
typedef struct MainDispatcherMigrateSeamlessDstCompleteMessage {
RedClient *client;
} MainDispatcherMigrateSeamlessDstCompleteMessage;
typedef struct MainDispatcherMmTimeLatencyMessage {
RedClient *client;
uint32_t latency;
} MainDispatcherMmTimeLatencyMessage;
typedef struct MainDispatcherClientDisconnectMessage {
RedClient *client;
} MainDispatcherClientDisconnectMessage;
/* channel_event - calls core->channel_event, must be done in main thread */
static void main_dispatcher_self_handle_channel_event(
int event,
SpiceChannelEventInfo *info)
{
reds_handle_channel_event(event, info);
}
static void main_dispatcher_handle_channel_event(void *opaque,
void *payload)
{
MainDispatcherChannelEventMessage *channel_event = payload;
main_dispatcher_self_handle_channel_event(channel_event->event,
channel_event->info);
}
void main_dispatcher_channel_event(int event, SpiceChannelEventInfo *info)
{
MainDispatcherChannelEventMessage msg = {0,};
if (pthread_self() == main_dispatcher.base.self) {
main_dispatcher_self_handle_channel_event(event, info);
return;
}
msg.event = event;
msg.info = info;
dispatcher_send_message(&main_dispatcher.base, MAIN_DISPATCHER_CHANNEL_EVENT,
&msg);
}
static void main_dispatcher_handle_migrate_complete(void *opaque,
void *payload)
{
MainDispatcherMigrateSeamlessDstCompleteMessage *mig_complete = payload;
reds_on_client_seamless_migrate_complete(mig_complete->client);
red_client_unref(mig_complete->client);
}
static void main_dispatcher_handle_mm_time_latency(void *opaque,
void *payload)
{
MainDispatcherMmTimeLatencyMessage *msg = payload;
reds_set_client_mm_time_latency(msg->client, msg->latency);
red_client_unref(msg->client);
}
static void main_dispatcher_handle_client_disconnect(void *opaque,
void *payload)
{
MainDispatcherClientDisconnectMessage *msg = payload;
spice_debug("client=%p", msg->client);
reds_client_disconnect(msg->client);
red_client_unref(msg->client);
}
void main_dispatcher_seamless_migrate_dst_complete(RedClient *client)
{
MainDispatcherMigrateSeamlessDstCompleteMessage msg;
if (pthread_self() == main_dispatcher.base.self) {
reds_on_client_seamless_migrate_complete(client);
return;
}
msg.client = red_client_ref(client);
dispatcher_send_message(&main_dispatcher.base, MAIN_DISPATCHER_MIGRATE_SEAMLESS_DST_COMPLETE,
&msg);
}
void main_dispatcher_set_mm_time_latency(RedClient *client, uint32_t latency)
{
MainDispatcherMmTimeLatencyMessage msg;
if (pthread_self() == main_dispatcher.base.self) {
reds_set_client_mm_time_latency(client, latency);
return;
}
msg.client = red_client_ref(client);
msg.latency = latency;
dispatcher_send_message(&main_dispatcher.base, MAIN_DISPATCHER_SET_MM_TIME_LATENCY,
&msg);
}
void main_dispatcher_client_disconnect(RedClient *client)
{
MainDispatcherClientDisconnectMessage msg;
if (!client->disconnecting) {
spice_debug("client %p", client);
msg.client = red_client_ref(client);
dispatcher_send_message(&main_dispatcher.base, MAIN_DISPATCHER_CLIENT_DISCONNECT,
&msg);
} else {
spice_debug("client %p already during disconnection", client);
}
}
static void dispatcher_handle_read(int fd, int event, void *opaque)
{
Dispatcher *dispatcher = opaque;
dispatcher_handle_recv_read(dispatcher);
}
/*
* FIXME:
* Reds routines shouldn't be exposed. Instead reds.c should register the callbacks,
* and the corresponding operations should be made only via main_dispatcher.
*/
void main_dispatcher_init(SpiceCoreInterface *core)
{
memset(&main_dispatcher, 0, sizeof(main_dispatcher));
main_dispatcher.core = core;
dispatcher_init(&main_dispatcher.base, MAIN_DISPATCHER_NUM_MESSAGES, &main_dispatcher.base);
core->watch_add(main_dispatcher.base.recv_fd, SPICE_WATCH_EVENT_READ,
dispatcher_handle_read, &main_dispatcher.base);
dispatcher_register_handler(&main_dispatcher.base, MAIN_DISPATCHER_CHANNEL_EVENT,
main_dispatcher_handle_channel_event,
sizeof(MainDispatcherChannelEventMessage), 0 /* no ack */);
dispatcher_register_handler(&main_dispatcher.base, MAIN_DISPATCHER_MIGRATE_SEAMLESS_DST_COMPLETE,
main_dispatcher_handle_migrate_complete,
sizeof(MainDispatcherMigrateSeamlessDstCompleteMessage), 0 /* no ack */);
dispatcher_register_handler(&main_dispatcher.base, MAIN_DISPATCHER_SET_MM_TIME_LATENCY,
main_dispatcher_handle_mm_time_latency,
sizeof(MainDispatcherMmTimeLatencyMessage), 0 /* no ack */);
dispatcher_register_handler(&main_dispatcher.base, MAIN_DISPATCHER_CLIENT_DISCONNECT,
main_dispatcher_handle_client_disconnect,
sizeof(MainDispatcherClientDisconnectMessage), 0 /* no ack */);
}