OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

9pfs: don't try to flush self and avoid QEMU hang on reset

Browse Source 
According to the 9P spec [*], when a client wants to cancel a pending I/O
request identified by a given tag (uint16), it must send a Tflush message
and wait for the server to respond with a Rflush message before reusing this
tag for another I/O. The server may still send a completion message for the
I/O if it wasn't actually cancelled but the Rflush message must arrive after
that.

QEMU hence waits for the flushed PDU to complete before sending the Rflush
message back to the client.

If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then
allocate a PDU identified by tag, find it in the PDU list and wait for
this same PDU to complete... i.e. wait for a completion that will never
happen. This causes a tag and ring slot leak in the guest, and a PDU
leak in QEMU, all of them limited by the maximal number of PDUs (128).
But, worse, this causes QEMU to hang on device reset since v9fs_reset()
wants to drain all pending I/O.

This insane behavior is likely to denote a bug in the client, and it would
deserve an Rerror message to be sent back. Unfortunately, the protocol
allows it and requires all flush requests to suceed (only a Tflush response
is expected).

The only option is to detect when we have to handle a self-referencing
flush request and report success to the client right away.

[*] http://man.cat-v.org/plan_9/5/flush

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Greg Kurz <groug@kaod.org>
This commit is contained in:
Greg Kurz 2017-03-21 09:12:47 +01:00
parent 940a8ce075
commit d5f2af7b95
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hw/9pfs/9p.c
View File

@ -2353,7 +2353,7 @@ static void coroutine_fn v9fs_flush(void *opaque)
ssize_t err;
int16_t tag;
size_t offset = 7;
V9fsPDU *cancel_pdu;
V9fsPDU *cancel_pdu = NULL;
V9fsPDU *pdu = opaque;
V9fsState *s = pdu->s;
@ -2364,9 +2364,13 @@ static void coroutine_fn v9fs_flush(void *opaque)
}
trace_v9fs_flush(pdu->tag, pdu->id, tag);
QLIST_FOREACH(cancel_pdu, &s->active_list, next) {
if (cancel_pdu->tag == tag) {
break;
if (pdu->tag == tag) {
error_report("Warning: the guest sent a self-referencing 9P flush request");
} else {
QLIST_FOREACH(cancel_pdu, &s->active_list, next) {
if (cancel_pdu->tag == tag) {
break;
}
}
}
if (cancel_pdu) {