Commit 751f8cfe authored by Greg Kurz's avatar Greg Kurz Committed by Dr. David Alan Gilbert
Browse files

monitor: fix dangling CPU pointer 



If a CPU selected with the "cpu" command is hot-unplugged then "info cpus"
causes QEMU to exit:

(qemu) device_del cpu1
(qemu) info cpus
qemu:qemu_cpu_kick_thread: No such process

This happens because "cpu" stores the pointer to the selected CPU into
the monitor structure. When the CPU is hot-unplugged, we end up with a
dangling pointer. The "info cpus" command then does:

hmp_info_cpus()
 monitor_get_cpu_index()
  mon_get_cpu()
   cpu_synchronize_state() <--- called with dangling pointer

This could cause a QEMU crash as well.

This patch switches the monitor to store the QOM path instead of a
pointer to the current CPU. The path is then resolved when needed.
If the resolution fails, we assume that the CPU was removed and the
path is resetted to the default (ie, path of first_cpu).

Reported-by: default avatarSatheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Suggested-by: default avatarIgor Mammedov <imammedo@redhat.com>
Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
Message-Id: <150822818243.26242.12993827911736928961.stgit@bahia.lan>
Reviewed-by: default avatarIgor Mammedov <imammedo@redhat.com>
Signed-off-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
parent 554a39eb

monitor.c

+18 −5
Original line number Diff line number Diff line
@@ -200,7 +200,7 @@ struct Monitor { 


    ReadLineState *rs;

    MonitorQMP qmp;

    CPUState *mon_cpu;

    gchar *mon_cpu_path;

    BlockCompletionFunc *password_completion_cb;

    void *password_opaque;

    mon_cmd_t *cmd_table;
@@ -579,6 +579,7 @@ static void monitor_data_init(Monitor *mon) 


static void monitor_data_destroy(Monitor *mon)

{

    g_free(mon->mon_cpu_path);

    qemu_chr_fe_deinit(&mon->chr, false);

    if (monitor_is_qmp(mon)) {

        json_message_parser_destroy(&mon->qmp.parser);
@@ -1047,20 +1048,32 @@ int monitor_set_cpu(int cpu_index) 
    if (cpu == NULL) {

        return -1;

    }

    cur_mon->mon_cpu = cpu;

    g_free(cur_mon->mon_cpu_path);

    cur_mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));

    return 0;

}



CPUState *mon_get_cpu(void)

{

    if (!cur_mon->mon_cpu) {

    CPUState *cpu;



    if (cur_mon->mon_cpu_path) {

        cpu = (CPUState *) object_resolve_path_type(cur_mon->mon_cpu_path,

                                                    TYPE_CPU, NULL);

        if (!cpu) {

            g_free(cur_mon->mon_cpu_path);

            cur_mon->mon_cpu_path = NULL;

        }

    }

    if (!cur_mon->mon_cpu_path) {

        if (!first_cpu) {

            return NULL;

        }

        monitor_set_cpu(first_cpu->cpu_index);

        cpu = first_cpu;

    }

    cpu_synchronize_state(cur_mon->mon_cpu);

    return cur_mon->mon_cpu;

    cpu_synchronize_state(cpu);

    return cpu;

}



CPUArchState *mon_get_cpu_env(void)