Skip to content
  • Greg Kurz's avatar
    751f8cfe
    monitor: fix dangling CPU pointer · 751f8cfe
    Greg Kurz authored
    
    
    If a CPU selected with the "cpu" command is hot-unplugged then "info cpus"
    causes QEMU to exit:
    
    (qemu) device_del cpu1
    (qemu) info cpus
    qemu:qemu_cpu_kick_thread: No such process
    
    This happens because "cpu" stores the pointer to the selected CPU into
    the monitor structure. When the CPU is hot-unplugged, we end up with a
    dangling pointer. The "info cpus" command then does:
    
    hmp_info_cpus()
     monitor_get_cpu_index()
      mon_get_cpu()
       cpu_synchronize_state() <--- called with dangling pointer
    
    This could cause a QEMU crash as well.
    
    This patch switches the monitor to store the QOM path instead of a
    pointer to the current CPU. The path is then resolved when needed.
    If the resolution fails, we assume that the CPU was removed and the
    path is resetted to the default (ie, path of first_cpu).
    
    Reported-by: default avatarSatheesh Rajendran <sathnaga@linux.vnet.ibm.com>
    Suggested-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
    Message-Id: <150822818243.26242.12993827911736928961.stgit@bahia.lan>
    Reviewed-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Signed-off-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
    751f8cfe
    monitor: fix dangling CPU pointer
    Greg Kurz authored
    
    
    If a CPU selected with the "cpu" command is hot-unplugged then "info cpus"
    causes QEMU to exit:
    
    (qemu) device_del cpu1
    (qemu) info cpus
    qemu:qemu_cpu_kick_thread: No such process
    
    This happens because "cpu" stores the pointer to the selected CPU into
    the monitor structure. When the CPU is hot-unplugged, we end up with a
    dangling pointer. The "info cpus" command then does:
    
    hmp_info_cpus()
     monitor_get_cpu_index()
      mon_get_cpu()
       cpu_synchronize_state() <--- called with dangling pointer
    
    This could cause a QEMU crash as well.
    
    This patch switches the monitor to store the QOM path instead of a
    pointer to the current CPU. The path is then resolved when needed.
    If the resolution fails, we assume that the CPU was removed and the
    path is resetted to the default (ie, path of first_cpu).
    
    Reported-by: default avatarSatheesh Rajendran <sathnaga@linux.vnet.ibm.com>
    Suggested-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
    Message-Id: <150822818243.26242.12993827911736928961.stgit@bahia.lan>
    Reviewed-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Signed-off-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
Loading