Commit d5f2af7b authored by Greg Kurz's avatar Greg Kurz
Browse files

9pfs: don't try to flush self and avoid QEMU hang on reset 

According to the 9P spec [*], when a client wants to cancel a pending I/O
request identified by a given tag (uint16), it must send a Tflush message
and wait for the server to respond with a Rflush message before reusing this
tag for another I/O. The server may still send a completion message for the
I/O if it wasn't actually cancelled but the Rflush message must arrive after
that.

QEMU hence waits for the flushed PDU to complete before sending the Rflush
message back to the client.

If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then
allocate a PDU identified by tag, find it in the PDU list and wait for
this same PDU to complete... i.e. wait for a completion that will never
happen. This causes a tag and ring slot leak in the guest, and a PDU
leak in QEMU, all of them limited by the maximal number of PDUs (128).
But, worse, this causes QEMU to hang on device reset since v9fs_reset()
wants to drain all pending I/O.

This insane behavior is likely to denote a bug in the client, and it would
deserve an Rerror message to be sent back. Unfortunately, the protocol
allows it and requires all flush requests to suceed (only a Tflush response
is expected).

The only option is to detect when we have to handle a self-referencing
flush request and report success to the client right away.

[*] http://man.cat-v.org/plan_9/5/flush



Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
parent 940a8ce0

hw/9pfs/9p.c

+8 −4
Original line number Diff line number Diff line
@@ -2353,7 +2353,7 @@ static void coroutine_fn v9fs_flush(void *opaque) 
    ssize_t err;

    int16_t tag;

    size_t offset = 7;

    V9fsPDU *cancel_pdu;

    V9fsPDU *cancel_pdu = NULL;

    V9fsPDU *pdu = opaque;

    V9fsState *s = pdu->s;
@@ -2364,11 +2364,15 @@ static void coroutine_fn v9fs_flush(void *opaque) 
    }

    trace_v9fs_flush(pdu->tag, pdu->id, tag);



    if (pdu->tag == tag) {

        error_report("Warning: the guest sent a self-referencing 9P flush request");

    } else {

        QLIST_FOREACH(cancel_pdu, &s->active_list, next) {

            if (cancel_pdu->tag == tag) {

                break;

            }

        }

    }

    if (cancel_pdu) {

        cancel_pdu->cancelled = 1;

        /*