char-socket: return -1 in case of disconnect during tcp_chr_write
During testing of the vhost-user-blk reconnect functionality the qemu
SIGSEGV was triggered:
start qemu as:
x86_64-softmmu/qemu-system-x86_64 -m 1024M -M q35 \
-object memory-backend-file,id=ram-node0,size=1024M,mem-path=/dev/shm/qemu,share=on \
-numa node,cpus=0,memdev=ram-node0 \
-chardev socket,id=chardev0,path=./vhost.sock,noserver,reconnect=1 \
-device vhost-user-blk-pci,chardev=chardev0,num-queues=4 --enable-kvm
start vhost-user-blk daemon:
./vhost-user-blk -s ./vhost.sock -b test-img.raw
If vhost-user-blk will be killed during the vhost initialization
process, for instance after getting VHOST_SET_VRING_CALL command, then
QEMU will fail with the following backtrace:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x00005555559272bb in vhost_user_read (dev=0x7fffef2d53e0, msg=0x7fffffffd5b0)
at ./hw/virtio/vhost-user.c:260
260 CharBackend *chr = u->user->chr;
#0 0x00005555559272bb in vhost_user_read (dev=0x7fffef2d53e0, msg=0x7fffffffd5b0)
at ./hw/virtio/vhost-user.c:260
#1 0x000055555592acb8 in vhost_user_get_config (dev=0x7fffef2d53e0, config=0x7fffef2d5394 "", config_len=60)
at ./hw/virtio/vhost-user.c:1645
#2 0x0000555555925525 in vhost_dev_get_config (hdev=0x7fffef2d53e0, config=0x7fffef2d5394 "", config_len=60)
at ./hw/virtio/vhost.c:1490
#3 0x00005555558cc46b in vhost_user_blk_device_realize (dev=0x7fffef2d51a0, errp=0x7fffffffd8f0)
at ./hw/block/vhost-user-blk.c:429
#4 0x0000555555920090 in virtio_device_realize (dev=0x7fffef2d51a0, errp=0x7fffffffd948)
at ./hw/virtio/virtio.c:3615
#5 0x0000555555a9779c in device_set_realized (obj=0x7fffef2d51a0, value=true, errp=0x7fffffffdb88)
at ./hw/core/qdev.c:891
...
The problem is that vhost_user_write doesn't get an error after
disconnect and try to call vhost_user_read(). The tcp_chr_write()
routine should return -1 in case of disconnect. Indicate the EIO error
if this routine is called in the disconnected state.
This regression is specific to the "socket" chardev and was caused by this commit:
commit 271094474b65de1 ad7aaf729938de3 d9b9d0d36f (refs/bisect/bad)
Author: Dima Stepanov <email address hidden>
Date: Thu May 28 12:11:18 2020 +0300
char-socket: return -1 in case of disconnect during tcp_chr_write
During testing of the vhost-user-blk reconnect functionality the qemu 64-softmmu/ qemu-system- x86_64 -m 1024M -M q35 \ backend- file,id= ram-node0, size=1024M, mem-path= /dev/shm/ qemu,share= on \ 0,memdev= ram-node0 \ id=chardev0, path=./ vhost.sock, noserver, reconnect= 1 \ blk-pci, chardev= chardev0, num-queues= 4 --enable-kvm vhost-user- blk -s ./vhost.sock -b test-img.raw
SIGSEGV was triggered:
start qemu as:
x86_
-object memory-
-numa node,cpus=
-chardev socket,
-device vhost-user-
start vhost-user-blk daemon:
./
If vhost-user-blk will be killed during the vhost initialization VRING_CALL command, then
process, for instance after getting VHOST_SET_
QEMU will fail with the following backtrace:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 59272bb in vhost_user_read (dev=0x7fffef2d 53e0, msg=0x7fffffffd5b0) vhost-user. c:260
0x000055555
at ./hw/virtio/
260 CharBackend *chr = u->user->chr;
#0 0x00005555559272bb in vhost_user_read (dev=0x7fffef2d 53e0, msg=0x7fffffffd5b0) vhost-user. c:260 get_config (dev=0x7fffef2d 53e0, config= 0x7fffef2d5394 "", config_len=60) vhost-user. c:1645 get_config (hdev=0x7fffef2 d53e0, config= 0x7fffef2d5394 "", config_len=60) vhost.c: 1490 blk_device_ realize (dev=0x7fffef2d 51a0, errp=0x7fffffff d8f0) vhost-user- blk.c:429 device_ realize (dev=0x7fffef2d 51a0, errp=0x7fffffff d948) virtio. c:3615 51a0, value=true, errp=0x7fffffff db88) qdev.c: 891
at ./hw/virtio/
#1 0x000055555592acb8 in vhost_user_
at ./hw/virtio/
#2 0x0000555555925525 in vhost_dev_
at ./hw/virtio/
#3 0x00005555558cc46b in vhost_user_
at ./hw/block/
#4 0x0000555555920090 in virtio_
at ./hw/virtio/
#5 0x0000555555a9779c in device_set_realized (obj=0x7fffef2d
at ./hw/core/
...
The problem is that vhost_user_write doesn't get an error after
disconnect and try to call vhost_user_read(). The tcp_chr_write()
routine should return -1 in case of disconnect. Indicate the EIO error
if this routine is called in the disconnected state.
Signed-off-by: Dima Stepanov <email address hidden>
Reviewed-by: Marc-André Lureau <email address hidden>
Message-Id: <email address hidden>
Reviewed-by: Michael S. Tsirkin <email address hidden>
Signed-off-by: Michael S. Tsirkin <email address hidden>