There are few control flows in vhost's implementation where vhost_net_stop() may be re entered several times in a row. This leads to triggering of assertion while duble freeing of same resources.
For example, if vhost-user socket disconnection occured: [-------------------------------- cut -----------------------------------] [guest]# echo -n '0000:00:01.0' > /sys/bus/pci/drivers/virtio-pci/unbind qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: Failed to read msg header. Read 0 instead of 12. Original request 11. qemu: /qemu/memory.c:1852: memory_region_del_eventfd: Assertion `i != mr->ioeventfd_nb' failed. Child terminated with signal = 0x6 (SIGABRT) GDBserver exiting [-------------------------------- cut -----------------------------------] [host]# gdb Breakpoint 1 in virtio_pci_set_host_notifier_internal() #0 virtio_pci_set_host_notifier_internal #1 vhost_dev_disable_notifiers #2 vhost_net_stop_one #3 vhost_net_stop (dev=dev@entry=0x13a45f8, ncs=0x1ce89f0, <...>) #4 virtio_net_vhost_status #5 virtio_net_set_status #6 qmp_set_link (<...>, up=up@entry=false, <...>) #7 net_vhost_user_event (<...>, event=5) #8 qemu_chr_be_event #9 tcp_chr_disconnect #10 tcp_chr_sync_read #11 qemu_chr_fe_read_all #12 vhost_user_read #13 vhost_user_get_vring_base #14 vhost_virtqueue_stop #15 vhost_dev_stop #16 vhost_net_stop_one #17 vhost_net_stop (dev=dev@entry=0x13a45f8, ncs=0x1ce89f0, <...>) #18 virtio_net_vhost_status #19 virtio_net_set_status #20 virtio_set_status <...> [-------------------------------- cut -----------------------------------] In example above assertion will fail when control will be brought back to function at #17 and it will try to free 'eventfd' that was already freed at call #3. Fix that by disallowing execution of vhost_net_stop() if we're already inside of it. Signed-off-by: Ilya Maximets <i.maxim...@samsung.com> --- hw/net/vhost_net.c | 8 ++++++++ hw/net/virtio-net.c | 1 + include/hw/virtio/virtio-net.h | 1 + 3 files changed, 10 insertions(+) diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 55d5456..0996e5d 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -335,8 +335,14 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs, BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(dev))); VirtioBusState *vbus = VIRTIO_BUS(qbus); VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus); + VirtIONet *n = VIRTIO_NET(dev); int i, r; + if (n->vhost_stopping_in_progress) { + return; + } + n->vhost_stopping_in_progress = 1; + for (i = 0; i < total_queues; i++) { vhost_net_stop_one(get_vhost_net(ncs[i].peer), dev); put_vhost_net(ncs[i].peer); @@ -348,6 +354,8 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs, fflush(stderr); } assert(r >= 0); + + n->vhost_stopping_in_progress = 0; } void vhost_net_cleanup(struct vhost_net *net) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index e5456ef..9b1539c 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -149,6 +149,7 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t status) } n->vhost_started = 1; + n->vhost_stopping_in_progress = 0; r = vhost_net_start(vdev, n->nic->ncs, queues); if (r < 0) { error_report("unable to start vhost net: %d: " diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h index 0cabdb6..fc07385 100644 --- a/include/hw/virtio/virtio-net.h +++ b/include/hw/virtio/virtio-net.h @@ -74,6 +74,7 @@ typedef struct VirtIONet { uint8_t nouni; uint8_t nobcast; uint8_t vhost_started; + uint8_t vhost_stopping_in_progress; struct { uint32_t in_use; uint32_t first_multi; -- 2.5.0