From patchwork Wed Dec 2 02:46:37 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 551139 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 330EE1401DE for ; Wed, 2 Dec 2015 13:46:27 +1100 (AEDT) Received: from localhost ([::1]:55857 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3xR3-000129-3A for incoming@patchwork.ozlabs.org; Tue, 01 Dec 2015 21:46:25 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52396) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3xQi-0000ZO-95 for qemu-devel@nongnu.org; Tue, 01 Dec 2015 21:46:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a3xQg-0000wL-VN for qemu-devel@nongnu.org; Tue, 01 Dec 2015 21:46:04 -0500 Received: from ozlabs.org ([2401:3900:2:1::2]:51123) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3xQg-0000w2-Ie for qemu-devel@nongnu.org; Tue, 01 Dec 2015 21:46:02 -0500 Received: by ozlabs.org (Postfix, from userid 1007) id B002F1401DE; Wed, 2 Dec 2015 13:45:59 +1100 (AEDT) From: David Gibson To: mst@redhat.com, marcandre.lureau@redhat.com Date: Wed, 2 Dec 2015 13:46:37 +1100 Message-Id: <1449024397-9200-1-git-send-email-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.5.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2401:3900:2:1::2 Cc: qemu-devel@nongnu.org, David Gibson Subject: [Qemu-devel] [PATCH] tests/vhost-user-test: Fix potential use-after-free X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org ae31fb5 "vhost-user-test: wrap server in TestServer struct" cleaned up the handling of the test server in vhost-user-test. Unfortunately it introduced a subtle use-after-free if a race goes the wrong way. When the server structure is freed inside test_server_free() the GThread started earlier is still running inside g_main_loop_run(). That GMainLoop still has handlers active which reference the server structure, so if those trip before the program exits there's a use-after-free. I've had difficulty reproducing this locally, but for some reason it seems to trip every time on Travis builds - this has been breaking all my test builds there, which is why I notced it. This patch prevents the use after free. Unfortunately it looks like there are additional problems still breaking my Travis builds, but one problem at a time. Signed-off-by: David Gibson --- tests/vhost-user-test.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) NOTE: I'm not sure if fixing the race like this is the right approach. It might be simpler just to remove the test_server_free() entirely, letting the structure leak, since the program is about to terminate anyway. diff --git a/tests/vhost-user-test.c b/tests/vhost-user-test.c index e4c36af..c547165 100644 --- a/tests/vhost-user-test.c +++ b/tests/vhost-user-test.c @@ -216,9 +216,10 @@ static void read_guest_mem(TestServer *s) static void *thread_function(void *data) { - GMainLoop *loop; - loop = g_main_loop_new(NULL, FALSE); - g_main_loop_run(loop); + GMainLoop **loopp = data; + + *loopp = g_main_loop_new(NULL, FALSE); + g_main_loop_run(*loopp); return NULL; } @@ -590,6 +591,8 @@ int main(int argc, char **argv) char *qemu_cmd = NULL; int ret; char template[] = "/tmp/vhost-test-XXXXXX"; + GThread *thread; + GMainLoop *loop; g_test_init(&argc, &argv, NULL); @@ -613,7 +616,7 @@ int main(int argc, char **argv) server = test_server_new("test"); /* run the main loop thread so the chardev may operate */ - g_thread_new(NULL, thread_function, NULL); + thread = g_thread_new(NULL, thread_function, &loop); qemu_cmd = GET_QEMU_CMD(server); @@ -629,6 +632,9 @@ int main(int argc, char **argv) qtest_quit(s); } + g_main_loop_quit(loop); + g_thread_join(thread); + /* cleanup */ test_server_free(server);