From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a15a3af796-43ae3812-134a-4633-98ce-cbbdb2112f98-000000@eu-central-1.amazonses.com> Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022131.outbound.protection.outlook.com [52.101.66.131]) by lore.virtuozzo.com (Postfix) with ESMTPS id 8E8348017D for ; Tue, 20 Oct 2026 16:53:01 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MUIfdXuXyzGcLEh4+pfrJ6dLg4oDvhDpnJH+jiby1+DhkX2MXd8aXxrnlWgbVsMsCyvkiEbaGm5beCt9CYAjWW2hKMl0Iacgb5ZtjSSPh3QPEdxYXkmfg8rYeGNy2BHbSNmAKgu70BJkA/p6eplrwS9fiUCUq4qAPivtk9mC+vdErpPEqQzLqiUJCF/XKxu60BXIWyYZ6pxRvxEqHPLsVlrGql/ui421Ru9eba7z7yW/9yaZiDd/jiLRxfsk7paFMvQbrddzVseR3y6dzsQlSAJtULRtIC+bsLF2HzJi7yzcxqBR1g3PJ3pESYqZ+yK/f5PT8fST0UXyPVo4N3Hq3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=nGb7/Al8TKFL3BL0Yp8JN1Dr31hnriwYNT6QLv1so/E=; b=F+tUc8fkm3nPk4a6odnkkUWTamojuA+RSkmU9ShteFSZ6POaU1Dcm8rSwZ+d8popGz7/gfSIoSiPZ0gNBbnPhvn42gpKXVR75ZfPY1x1sP4uGc5BLJDIyEipzujPhPcHVAbApMWqrrXeoFFMuq19bKSpwM2CgaNJiB8TEmhoVWLxZfbkB44ISSFgJrpnH/Qbx7yzBabHNiHNzu6HljC6A40N5FWYTKDTRPs5VG84ckj1jKPz8ygYYAfz/4E13+2DAovLJdpUYFGrxUDE0A0WrAP/dmxzO1AkNvj+JzQXdrurNY8Ao0P5UTFcaZZDE0+eOrxf41iZJnZMrDAFFcHdZw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.2) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nGb7/Al8TKFL3BL0Yp8JN1Dr31hnriwYNT6QLv1so/E=; b=WsvQw4/WAqfTGnVJN0LNRzbC2cvDtQIiRMK++mm+QVaowTjWGlVmKMWm7wCPeaJDZQ4VwHWGvV75cYwRKQ10t+i4PmaEkK0jRuap6ZD+rAzwdkU0wR8nUeVZZyf6pEJhKPpIoqg0bioUB/ez1qPu93noWQLAeJL5HodRPObTb0k= Received: from MA3P292CA0067.ESPP292.PROD.OUTLOOK.COM (2603:10a6:250:49::8) by DBAPR08MB5767.eurprd08.prod.outlook.com (2603:10a6:10:1a7::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 16:52:57 +0000 Received: from MAD0EPF000008C5.eurprd05.prod.outlook.com (2603:10a6:250:49:cafe::46) by MA3P292CA0067.outlook.office365.com (2603:10a6:250:49::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 16:52:57 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.2) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.2 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.2; helo=b224-2.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-2.smtp-out.eu-central-1.amazonses.com (69.169.224.2) by MAD0EPF000008C5.mail.protection.outlook.com (10.167.241.201) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 16:52:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1792515176; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=baP7TKce9oWrFqnsV1MZj2rEBmbCcx4/HttrZ2mfRPo=; b=ItXUSjj/kz7YAVhgEgv+v1RFUhV2tbNWMYZiRfMjg2ig9+yKP69k/7dnpe0iyj6m MwIYfrI90nuxwJUjndAoTIz11kVP1qaUwgtty3NI+r8w+K3Ckfn2cwpe7BavKEDfSS5 dpvlAN3yuQU67Vu1is7jZpWrlcMfutJSzH6IjAA84N9NlySgDMF100kCP73ysdBhzaB Ifju45S8z2yt5mwNLC4CqdXQnXcNfHndQbWrHAX9cpF8z9zAT0GOJsNnt/JwOrmuuqZ OROhYQY6EPXrvS+HVmG0IzQK/KoRbt4wUkOc+83+kmoMgyMqgHongMZcQ3x7gkrdFTq vGsa1KB7CQ== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1792515176; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=baP7TKce9oWrFqnsV1MZj2rEBmbCcx4/HttrZ2mfRPo=; b=FcoJR+4RxndU0+PfOBfbSuW6PRcTh70nIQo5w7sIUz3rHz2vQSUf7Gl6fgcD0Cjs HQtVq1gvvFO7ADJTM8BIVyNuKUcB0Vj4021D7muMIImx9Dh4OTkNzv/fsSRulbA5WI9 2wgkV9ie/vvKstreZcHfxVtVULkAwpRLid+qaM6c= Message-ID: <010701a15a3af796-43ae3812-134a-4633-98ce-cbbdb2112f98-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v4 19/31] migration: Fix crash on second migration when cancel early To: Andrey Drobyshev , svt-core@virtuozzo.com In-Reply-To: <20261020-vfio_v1-v4-19-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> <20261020-vfio_v1-v4-19-83a5668230e5@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 20 Oct 2026 16:52:56 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.20-69.169.224.2 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MAD0EPF000008C5:EE_|DBAPR08MB5767:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: d7b1f357-a388-479e-694f-08df2eca977a X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|9140799003|376014|48200799018|32142699015|61400799027|55112099003|4113699003|5113699003|10063799003|10067099003|22082099003|16102099003|18002099003|3023799007|13003099007|4143699003|261009223027099003|5063699009|56012099006; X-Microsoft-Antispam-Message-Info: 01M1xxydMHXwd15wnaJihYbIV6z/8I6Lt/XKmydRTtf9y1H5KoK/CHgfjS8RshOeECqTqnwugazs7L3OBrFu4IZQ/oK/S7kE4KqLuAB10flzwSE7ECfmg1DcDh1MBIzEyQTML87VpI4nF+F7scdmYNGoghR/HJ4wSl7y/mdUOeuIELcXE7+bsYiDFPR9qtM+GOjdNY1nO70y39y1knMM+k1VQPthFckcmmxK6Ng+vV3Hvez58k+TmeJIQ3MjYymV4PIXV97eA7IFqTxXojcIfVi9ibT9w2UXdhr9EjWkigEm8dVjiDI9IeB2joGJfIgyowdRhhBq/bwWqFLilIx9y2mgFJWovJi9Xwed4q4gUmkt0YOHiIFzNZf8kqb0pZpmokZNeFwGO9cXp/iF3kftazU9aWUOjIEMTQUdrbTXw2IFomyK9syY8F+Ziwwr+oorsuknLXW37Cay+rd/pgRkzblgRZ+y1vVx7xUWt7nvABX6UEm3eVa1qi3aV2hmfwzK4d18NSkCHsuvj4/pZkrglvaUf4xnA1DNqcQk8VSGTvW4GEm/e6hkPJwxcPMaRCHZKlMA+5MeSFu2NrrExKVL3yrk4LIY7TgiBSqs1aWjgEykl3VlWxaJUWiO7CSX9W3KWUywLjHy7HqZGqoWmiKyF8h1+q/EoR3q7HZho6Ta9qNUJew+uzAXHtVEltkcIgxw/OsZLH+33kqYgfw5oFNtmP4iNFhfKUr7Vwanlz0uGg1YBWlQ7m/oE7XMYI3KwVFJSlXRYoWifzhbuwZ14SrOIoU5i796HrHkFPT9190UusBbTTvlwvKxmX2xv9xMZAgL+RVm80wbydWJoqFitO3b/V7B8NobyglUOXDGd9MSBZ8= X-Forefront-Antispam-Report: CIP:69.169.224.2;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-2.smtp-out.eu-central-1.amazonses.com;PTR:b224-2.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704161411799003)(9140799003)(376014)(48200799018)(32142699015)(61400799027)(55112099003)(4113699003)(5113699003)(10063799003)(10067099003)(22082099003)(16102099003)(18002099003)(3023799007)(13003099007)(4143699003)(261009223027099003)(5063699009)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: mBf/d7NEYhf/JV6gyItVDacjyyPwvBIy7e4H5/vPY8GFyGWdxNZox1EsyyG+RTrKojMQ1WdZ42iUV1e+ATeMWnJSFjJd/ICeyUpRXSEgBVNxEQMwnf8kzc9hR0nq4QeA5DXX8fKaNxaz4vPEc5iV0PkT3wpwhYqPf6mbVXwH7g35M9zbn5yAPnkDQkFpbWddu4Owmdr7LRJDfXCCVcYYA+bDQMOTqgDOF3nXh3Gto+dSghEwEMCUDyn3D4PrvouiPO43aMKsweI+a9szg0yySwZdFK1eU0iKRnSRnzOLZzC5qjymc6qTIVmZvyjP7CJOi13I1nXcwMjKDZdpDadcIMSChaggqZUwcKWPewgf27fa61TG30+QFSxftQ0mzRCb1/b8Sv/fQP0BfBhh4cGCDGGiXjJ451Sa2hK/7Eu73w5q3gdsQWH8jJ2Ek7qWKAF8 X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:52:56.8633 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d7b1f357-a388-479e-694f-08df2eca977a X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MAD0EPF000008C5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR08MB5767 Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: - [High] migration: cancel in cpr-transfer HUP window sends FAILED without = SETUP, can abort via VFIO notifier - [Medium] migration: migration_cancel() asserts on mode that migrate-set-p= arameters can change - [Low] migration: qmp_migrate_finish_cb() comment refers to a nonexistent = redundant destroy -- commit e43a55e4327f60b3f762f7e2bead9f8ce8624d43 Author: Peter Xu migration: Fix crash on second migration when cancel early This commit makes migration_cancel() call migration_cleanup() when the cpr-transfer HUP gsource is still pending. It also detaches hup_source at entry to qmp_migrate_finish_cb(), and adds some assertions. This fixes a crash when a cancelled early-setup migration is retried. Link: https://lore.kernel.org/r/20260417184742.293061-1-marcandre.lureau@re= dhat.com Link: https://lore.kernel.org/r/20260421175820.302795-1-peterx@redhat.com > diff --git a/migration/migration.c b/migration/migration.c > index b7db5c94b0d9..3732751e66c7 100644 > --- a/migration/migration.c > +++ b/migration/migration.c [ ... ] > @@ -1661,14 +1661,19 @@ void migration_cancel(void) > } > =20 > /* > - * If qmp_migrate_finish has not been called, then there is no path = that > - * will complete the cancellation. Do it now. > + * This is cpr-transfer specific processing. > + * > + * If this is true, it means cpr-transfer migration is waiting for t= he > + * destination to send HUP event on CPR channel to continue the next > + * phase. If so, do the cleanup proactively to avoid get stuck in > + * CANCELLING state. > */ > - if (setup && !s->to_dst_file) { > - migrate_set_state(&s->state, MIGRATION_STATUS_CANCELLING, > - MIGRATION_STATUS_CANCELLED); > - cpr_state_close(); > - cpr_transfer_source_destroy(s); > + if (cpr_transfer_source_active(s)) { > + assert(migrate_mode() =3D=3D MIG_MODE_CPR_TRANSFER); > + assert(setup && !s->to_dst_file); > + migration_cleanup(s); > + /* Now all things should have been released */ > + assert(!cpr_transfer_source_active(s)); > } > } [Severity: High] Can this migration_cleanup() call abort QEMU through a VFIO notifier? In the cpr-transfer HUP-wait window, qmp_migrate() has only called cpr_transfer_add_hup_watch() and returned. migration_connect() has not run, so migration_call_notifiers(MIG_EVENT_PRECOPY_SETUP) has not been delivered. The SETUP handler vfio_cpr_pci_notifier(), which disables the MSI/INTx irqfds, has therefore not run. If migrate_cancel arrives in this window, migration_cancel() calls migration_cleanup(), which ends with: type =3D migration_has_failed(s) ? MIG_EVENT_PRECOPY_FAILED : MIG_EVENT_PRECOPY_DONE; migration_call_notifiers(type, NULL); For MIG_EVENT_PRECOPY_FAILED, vfio_cpr_pci_notifier() calls vfio_cpr_set_msi_virq(vdev, errp, true). That re-adds irqfds which were never removed. If KVM_IRQFD assign rejects the duplicate, the notifier returns non-zero. I have not verified the kernel behaviour for a duplicate assign. migration_call_notifiers() then reaches: ret =3D notifier->notify(notifier, &e, errp); if (ret) { assert(type =3D=3D MIG_EVENT_PRECOPY_SETUP); That assert would fire for a FAILED event and abort the running source QEMU. The old code in this path sent no notifier events. Is it intended that FAILED is delivered here without a preceding SETUP, and is vfio_cpr_pci_notifier() expected to tolerate that? The commit message does not mention this side effect. [Severity: Medium] Can assert(migrate_mode() =3D=3D MIG_MODE_CPR_TRANSFER) fire here? migrate_mode() reads the live s->parameters.mode. migrate_params_apply() applies has_mode with no check for a running migration: if (params->has_mode) { s->parameters.mode =3D params->mode; } qmp_migrate() samples the mode only once, when it calls cpr_transfer_add_hup_watch(), and does not record it. Consider this sequence: qmp_migrate() /* cpr-transfer, hup_source set */ migrate-set-parameters mode=3Dnormal migrate_cancel (or migration_shutdown() at exit) migration_cancel() cpr_transfer_source_active(s) /* true */ assert(migrate_mode() =3D=3D MIG_MODE_CPR_TRANSFER) /* fails */ That would abort QEMU in a case where the old code just cancelled and cleaned up. The cleanup itself does not depend on the mode. Is this assertion needed? > @@ -2266,11 +2271,22 @@ static gboolean qmp_migrate_finish_cb(QIOChannel = *channel, > void *opaque) > { > MigrationAddress *addr =3D opaque; > + MigrationState *s =3D migrate_get_current(); > + > + /* > + * Detach and release the GSource right after use. We rely on this = to > + * detect this small cpr-transfer window of "waiting for HUP event". > + */ > + cpr_transfer_source_destroy(s); > =20 > qmp_migrate_finish(addr, NULL); > =20 > cpr_state_close(); > - cpr_transfer_source_destroy(migrate_get_current()); > + > + /* > + * This is redundant as we do cpr_transfer_source_destroy() at the > + * entry, but it's benign; glib will just skip the detach. > + */ > return G_SOURCE_REMOVE; > } [Severity: Low] This isn't a bug, but the new comment before return G_SOURCE_REMOVE says "This is redundant as we do cpr_transfer_source_destroy() at the entry". No second cpr_transfer_source_destroy() call remains in qmp_migrate_finish_cb(), because the patch removes the trailing one. The comment seems to describe code that is not present in this backport. Could it be reworded or dropped? --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261020-vfio= _v1-v4-0-83a5668230e5@virtuozzo.com?part=3D19