Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2225881/?format=api
{ "id": 2225881, "url": "http://patchwork.ozlabs.org/api/patches/2225881/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260421175820.302795-1-peterx@redhat.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260421175820.302795-1-peterx@redhat.com>", "list_archive_url": null, "date": "2026-04-21T17:58:20", "name": "migration: Fix crash on second migration when cancel early", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "e97b3a43068969b715fb0beca04f9ddab98efdbf", "submitter": { "id": 67717, "url": "http://patchwork.ozlabs.org/api/people/67717/?format=api", "name": "Peter Xu", "email": "peterx@redhat.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260421175820.302795-1-peterx@redhat.com/mbox/", "series": [ { "id": 500864, "url": "http://patchwork.ozlabs.org/api/series/500864/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=500864", "date": "2026-04-21T17:58:20", "name": "migration: Fix crash on second migration when cancel early", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500864/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2225881/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2225881/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=WFqyWKsF;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=google header.b=mwRPAKn/;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0VTx54M0z1yHB\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 22 Apr 2026 03:59:00 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wFFMq-0005iM-Rn; Tue, 21 Apr 2026 13:58:36 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <peterx@redhat.com>) id 1wFFMk-0005i5-Lo\n for qemu-devel@nongnu.org; Tue, 21 Apr 2026 13:58:31 -0400", "from us-smtp-delivery-124.mimecast.com ([170.10.129.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <peterx@redhat.com>) id 1wFFMh-0007mB-LP\n for qemu-devel@nongnu.org; Tue, 21 Apr 2026 13:58:30 -0400", "from mail-qt1-f200.google.com (mail-qt1-f200.google.com\n [209.85.160.200]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-235-7ZgfbgvbOeCsE6OrnjrFtw-1; Tue, 21 Apr 2026 13:58:23 -0400", "by mail-qt1-f200.google.com with SMTP id\n d75a77b69052e-50faf1ecd1dso26363251cf.1\n for <qemu-devel@nongnu.org>; Tue, 21 Apr 2026 10:58:23 -0700 (PDT)", "from x1.local ([142.189.10.167]) by smtp.gmail.com with ESMTPSA id\n d75a77b69052e-50e393ff941sm115011041cf.19.2026.04.21.10.58.21\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 21 Apr 2026 10:58:21 -0700 (PDT)" ], "DKIM-Signature": [ "v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776794306;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding;\n bh=G1eiFvw6KQZKCI4K+duPivHjMWHsUAyn2BHrPqH8pHc=;\n b=WFqyWKsFLJ2s9aWKAsFGxINQYayflQLlglPeuZr0maixKPvyeRZhbFaz8XzPrscN5oaxa4\n EdTPGoTbCWaXjwWK0zssGplnJXTQXXZ7CdzD3ru8QKKR4JDU/TQbohJ3WItDZB2wM1Wukq\n P86EtSeEwnKyPGGPC1qBb62Np3Ng8I4=", "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=redhat.com; s=google; t=1776794303; x=1777399103; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=G1eiFvw6KQZKCI4K+duPivHjMWHsUAyn2BHrPqH8pHc=;\n b=mwRPAKn/5Qp6s+5BIzsUd+elpV1SZDtC/p75CsPmWwrz271SsTKlzz/L0uhuFmxeQm\n K+nEpWPLs8UeR/waQ/Of35j4SNJvI5m3kDQvGgGiZMK/EJEzaW7pXm40rQN4iUE9MlHS\n BbLmUMvHnF6LYRCaAHMNelhnRiiCIswwWVOQTbY1nI6PGRwpe0IqiRE08TZI+hBiIl+h\n YHa14FcoOs5WuUvoulqVWMEVclGoPpZcKeXhEmUTn2z1Y3JTVtr6FTeJP6sr+hXk0p/X\n dAYjALOcV4xZfPJudyEk5Q4vPcqAGY2xuvsw7yjDQllmjVUErFG8DpGT5XaKLn7tgqsa\n wfTQ==" ], "X-MC-Unique": "7ZgfbgvbOeCsE6OrnjrFtw-1", "X-Mimecast-MFC-AGG-ID": "7ZgfbgvbOeCsE6OrnjrFtw_1776794303", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776794303; x=1777399103;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=G1eiFvw6KQZKCI4K+duPivHjMWHsUAyn2BHrPqH8pHc=;\n b=KTrRt0X0C8kGkNc60AGS/paNlGfF3z8CsvU92b6uVR3ClSCqYPzLCbOkYEhJa/gNGc\n RA0KlqjdO8W7r7HyWQru5JeBopxcUT3DWR7pVaHtph7u5Q03vowMsOAcZnp6hv9uP8FE\n K81tGcb8iBKKloTB3zTaP113KsnZqXHQ0gTH6tgEEMYi55FwFpSW/splcRroo7NAVDWq\n q7qB1rQfZmLCjimkw/yAOvYrWok5NPuobRZXt4xxNiGOaKNLu5cmsjQvaidsvyZF7BH5\n s/7E8kB861RxPUU0lN+XrjP1DiPvL9UpQBUjNuog4Xm2ymjHZK+i51L4wjeW7mGbWCt0\n 8JjQ==", "X-Gm-Message-State": "AOJu0YzYty/o1bw65ohjuvCM5s7/ydcuZTrr4tBPTnANucjdGzI5t0CE\n 41cen2CnFFv2dHC40/BhF9OePP6hvhvxRKuN2oINL1qartT6VNr4KyWVe69/COiL+c2PM0sqSJg\n HnaA8E49I6p57KKv9HTmj1JZQX2EsrdccA4FR50zJ4zkkfxl5/Pef+gOLmI3OenigZ8oZx+hufq\n E0bOsykfj0l4dvdxZ9BEYMrOsbR06Bknwzv5BOMQ==", "X-Gm-Gg": "AeBDies5oTxlttRtJ81MMYxwqbX2M2MeZUIsw+D3+e02PLITH+7+wGP7ylBRGUm+xAF\n ++EeH3/WaWJzp3E4e9DCkKk+d711f7i1qB3rqPwaWCNzue+yARFaK2QSUqkx3wExjtdiZb9QIhn\n FgCydYE5TSdxE7A45GfGyJHbHpRCxwji+QodeGYOuJ9V0V2ofveWeFcHlab50523ZGLO/qSQhua\n 9WUyLkDcwZXOj6oltOvK6ZrWl53TfmH2drzwAC+KD1Icuu27ZNDc93Wqd20Jr30XYPOYnlnKp2T\n SHTY1mq672lp9a5kQs0iZ0U7M4Umo1ta/2Ug7oTqmPpYKOkij2fbp0WojCTyMHuQxDJw46SRkp6\n 3lKGu490yCbwmq59Gd30/m9AD/FBBg7LWO3Cna1Ke+TOE4fJ++g/3cOtXxg==", "X-Received": [ "by 2002:a05:622a:2606:b0:50d:81c4:4c79 with SMTP id\n d75a77b69052e-50e36c143bbmr290048261cf.35.1776794302714;\n Tue, 21 Apr 2026 10:58:22 -0700 (PDT)", "by 2002:a05:622a:2606:b0:50d:81c4:4c79 with SMTP id\n d75a77b69052e-50e36c143bbmr290047691cf.35.1776794302080;\n Tue, 21 Apr 2026 10:58:22 -0700 (PDT)" ], "From": "Peter Xu <peterx@redhat.com>", "To": "qemu-devel@nongnu.org", "Cc": "Fabiano Rosas <farosas@suse.de>, Peter Xu <peterx@redhat.com>,\n Prasad Pandit <ppandit@redhat.com>, Ben Chaney <bchaney@akamai.com>,\n Juraj Marcin <jmarcin@redhat.com>, Mark Kanda <mark.kanda@oracle.com>,\n Pranav Tyagi <prtyagi@redhat.com>,\n =?utf-8?q?Marc-Andr=C3=A9_Lureau?= <marcandre.lureau@redhat.com>", "Subject": "[PATCH] migration: Fix crash on second migration when cancel early", "Date": "Tue, 21 Apr 2026 13:58:20 -0400", "Message-ID": "<20260421175820.302795-1-peterx@redhat.com>", "X-Mailer": "git-send-email 2.53.0", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=170.10.129.124; envelope-from=peterx@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "Marc-André reported an issue on QEMU crash when retrying a cancelled\nmigration during early setup phase, see \"Link:\" for more information, and\nalso easy way to reproduce.\n\nThis patch is a replacement of the prior fix proposed by not only switching\nto migration_cleanup(), but also fixing it from CPR side, so that we track\nhup_source properly to know if src QEMU is waiting or the HUP signal.\n\nTo put it simple: this chunk of special casing in migration_cancel() should\nnot affect normal migration, but only cpr-transfer migration to cover the\nsmall window when the src QEMU is waiting for a HUP signal on cpr\nchannel (so that src QEMU can continue the migration on the main channel).\n\nTo achieve that, we'll also need to remember to detach the hup_source\nwhenenver invoked: after that point, we should always be able to cleanup\nthe migration.\n\nIt's not a generic operation to explicitly detach a gsource from its\ncontext while in its dispatch() function. But it should be safe, because\ngsource disptch() will only happen with a boosted refcount for the\ndispatcher so that the gsource will not be freed until the callback\ncompletes. It's also safe to return G_SOURCE_REMOVE after the gsource is\ndetached, as glib will simply ignore the G_SOURCE_REMOVE.\n\nOne can refer to latest 2.86.5 glib code in g_main_dispatch() for that:\n\nhttps://github.com/GNOME/glib/blob/2.86.5/glib/gmain.c#L3592\n\nWhen at this, add a bunch of assertions to make sure nothing surprises us.\n\nAfter this patch applied, the 2nd migration will not crash QEMU, instead\nit'll be in CANCELLING until the socket connection times out (it will take\n~2min on my Fedora default kernel). During this process no 2nd migration\nwill be allowed, and after it timed out migration can be restarted.\n\nIt's because so far we don't have control over socket_connect_outgoing(),\nor anything yet managed by a task executed in qio_task_run_in_thread().\nSpeeding up the cancellation to be left for future.\n\nI also tested cpr-transfer by only providing cpr channel not the main\nchannel (with -incoming defer), kickoff migration on source, then cancel it\non source directly without providing the main channel. It keeps working.\n\nI wanted to add an unit test for that but it'll need to refactor current\ncpr-transfer tests first; let's leave it for later.\n\nLink: https://lore.kernel.org/r/20260417184742.293061-1-marcandre.lureau@redhat.com\nReported-by: Marc-André Lureau <marcandre.lureau@redhat.com>\nSigned-off-by: Peter Xu <peterx@redhat.com>\n---\n include/migration/cpr.h | 1 +\n migration/migration.h | 5 +++++\n migration/cpr-transfer.c | 10 ++++++++++\n migration/migration.c | 31 +++++++++++++++++++++++--------\n 4 files changed, 39 insertions(+), 8 deletions(-)", "diff": "diff --git a/include/migration/cpr.h b/include/migration/cpr.h\nindex 5850fd1788..ebf09a2f0a 100644\n--- a/include/migration/cpr.h\n+++ b/include/migration/cpr.h\n@@ -57,6 +57,7 @@ QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);\n void cpr_transfer_add_hup_watch(MigrationState *s, QIOChannelFunc func,\n void *opaque);\n void cpr_transfer_source_destroy(MigrationState *s);\n+bool cpr_transfer_source_active(MigrationState *s);\n \n void cpr_exec_init(void);\n QEMUFile *cpr_exec_output(Error **errp);\ndiff --git a/migration/migration.h b/migration/migration.h\nindex b6888daced..2bc2787480 100644\n--- a/migration/migration.h\n+++ b/migration/migration.h\n@@ -514,6 +514,11 @@ struct MigrationState {\n bool postcopy_package_loaded;\n QemuEvent postcopy_package_loaded_event;\n \n+ /*\n+ * When set, it means cpr-transfer is waiting for the HUP signal from\n+ * destination to continue the 2nd step of migration via the main\n+ * channel.\n+ */\n GSource *hup_source;\n \n /*\ndiff --git a/migration/cpr-transfer.c b/migration/cpr-transfer.c\nindex 61d5c9dce2..9defe7bad7 100644\n--- a/migration/cpr-transfer.c\n+++ b/migration/cpr-transfer.c\n@@ -6,6 +6,7 @@\n */\n \n #include \"qemu/osdep.h\"\n+#include \"qemu/main-loop.h\"\n #include \"qapi/clone-visitor.h\"\n #include \"qapi/error.h\"\n #include \"qapi/qapi-visit-migration.h\"\n@@ -79,6 +80,7 @@ QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp)\n void cpr_transfer_add_hup_watch(MigrationState *s, QIOChannelFunc func,\n void *opaque)\n {\n+ assert(bql_locked());\n s->hup_source = qio_channel_create_watch(cpr_state_ioc(), G_IO_HUP);\n g_source_set_callback(s->hup_source,\n (GSourceFunc)func,\n@@ -89,9 +91,17 @@ void cpr_transfer_add_hup_watch(MigrationState *s, QIOChannelFunc func,\n \n void cpr_transfer_source_destroy(MigrationState *s)\n {\n+ assert(bql_locked());\n if (s->hup_source) {\n g_source_destroy(s->hup_source);\n g_source_unref(s->hup_source);\n s->hup_source = NULL;\n }\n }\n+\n+bool cpr_transfer_source_active(MigrationState *s)\n+{\n+ /* Whenever the HUP gsource is available, it's active. */\n+ assert(bql_locked());\n+ return s->hup_source;\n+}\ndiff --git a/migration/migration.c b/migration/migration.c\nindex 5c9aaa6e58..58c1e56766 100644\n--- a/migration/migration.c\n+++ b/migration/migration.c\n@@ -1469,14 +1469,19 @@ void migration_cancel(void)\n }\n \n /*\n- * If migration_connect_outgoing has not been called, then there\n- * is no path that will complete the cancellation. Do it now.\n- */\n- if (setup && !s->to_dst_file) {\n- migrate_set_state(&s->state, MIGRATION_STATUS_CANCELLING,\n- MIGRATION_STATUS_CANCELLED);\n- cpr_state_close();\n- cpr_transfer_source_destroy(s);\n+ * This is cpr-transfer specific processing.\n+ *\n+ * If this is true, it means cpr-transfer migration is waiting for the\n+ * destination to send HUP event on CPR channel to continue the next\n+ * phase. If so, do the cleanup proactively to avoid get stuck in\n+ * CANCELLING state.\n+ */\n+ if (cpr_transfer_source_active(s)) {\n+ assert(migrate_mode() == MIG_MODE_CPR_TRANSFER);\n+ assert(setup && !s->to_dst_file);\n+ migration_cleanup(s);\n+ /* Now all things should have been released */\n+ assert(!cpr_transfer_source_active(s));\n }\n }\n \n@@ -2009,12 +2014,22 @@ static gboolean migration_connect_outgoing_cb(QIOChannel *channel,\n MigrationState *s = migrate_get_current();\n Error *local_err = NULL;\n \n+ /*\n+ * Detach and release the GSource right after use. We rely on this to\n+ * detect this small cpr-transfer window of \"waiting for HUP event\".\n+ */\n+ cpr_transfer_source_destroy(s);\n+\n migration_connect_outgoing(s, opaque, &local_err);\n \n if (local_err) {\n migration_connect_error_propagate(s, local_err);\n }\n \n+ /*\n+ * This is redundant as we do cpr_transfer_source_destroy() at the\n+ * entry, but it's benign; glib will just skip the detach.\n+ */\n return G_SOURCE_REMOVE;\n }\n \n", "prefixes": [] }