[Xen-devel] question about SIGSEGV in datacopier_readable in libxl_aoutil.c

[Chunyan Liu <cyliu@xxxxxxxx>]

Hi, List,

I'm trying to add migration APIs to libvirt libxl driver. In testing HVM migration, on source side, when executing libxl_domain_suspend, often meet SIGSEGV in libxl_aoutil.c: datacopier_readable, the malloc() function place:
ÂÂÂÂÂ if (!buf || buf->used >= sizeof(buf->buf)) {
ÂÂÂÂÂÂÂÂÂÂÂ buf = malloc(sizeof(*buf));

I doubt the heap is corrupted someway but couldn't confirm the root cause. And I tried valgrind to find some clue, following is the info right before the SIGSEGV.

#valgrind --leak-check=full /usr/sbin/libvirtd -l -d

[snip]

==7510== Syscall param read(buf) points to unaddressable byte(s)
==7510==ÂÂÂ at 0x8ECC76D: ??? (syscall-template.S:82)
==7510==ÂÂÂ by 0x14AB3070: datacopier_readable (unistd.h:45)
==7510==ÂÂÂ by 0x14AB833C: afterpoll_internal (libxl_event.c:995)
==7510==ÂÂÂ by 0x14AB8F16: eventloop_iteration (libxl_event.c:1440)
==7510==ÂÂÂ by 0x14AB9439: libxl__ao_inprogress (libxl_event.c:1685)
==7510==ÂÂÂ by 0x14A9ABF7: libxl_domain_suspend (libxl.c:785)
==7510==ÂÂÂ by 0x148404B3: libxlDomainMigratePerform3 (libxl_driver.c:5100)
==7510==ÂÂÂ by 0x5390CFA: virDomainMigratePerform3 (libvirt.c:7050)
==7510==ÂÂÂ by 0x12C262: remoteDispatchDomainMigratePerform3Helper (remote.c:3507)
==7510==ÂÂÂ by 0x53EACBE: virNetServerProgramDispatch (virnetserverprogram.c:435)
==7510==ÂÂÂ by 0x53EBCBD: virNetServerProcessMsg (virnetserver.c:165)
==7510==ÂÂÂ by 0x53EC912: virNetServerHandleJob (virnetserver.c:186)
==7510==Â Address 0x18a409ec is 0 bytes after a block of size 28 alloc'd
==7510==ÂÂÂ at 0x4C26FFB: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7510==ÂÂÂ by 0x14AAECB6: libxl__zalloc (libxl_internal.c:83)
==7510==ÂÂÂ by 0x14AB33B0: libxl__datacopier_prefixdata (libxl_aoutils.c:92)
==7510==ÂÂÂ by 0x14AA6CDC: libxl__domain_save_device_model (libxl_dom.c:1447)
==7510==ÂÂÂ by 0x14AA8097: libxl__xc_domain_save_done (libxl_dom.c:1382)
==7510==ÂÂÂ by 0x14AB4268: helper_done (libxl_save_callout.c:332)
==7510==ÂÂÂ by 0x14AB4CA2: helper_exited (libxl_save_callout.c:317)
==7510==ÂÂÂ by 0x14ABB274: childproc_reaped (libxl_fork.c:264)
==7510==ÂÂÂ by 0x14ABB97A: libxl__fork_selfpipe_woken (libxl_fork.c:300)
==7510==ÂÂÂ by 0x14AB83A0: afterpoll_internal (libxl_event.c:1008)
==7510==ÂÂÂ by 0x14AB8F16: eventloop_iteration (libxl_event.c:1440)
==7510==ÂÂÂ by 0x14AB9439: libxl__ao_inprogress (libxl_event.c:1685)
==7510==
--7510-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--7510-- si_code=80;Â Faulting address: 0x0;Â sp: 0x406ad5da0

I couldn't find a clear problem in the code, but after trying to change the code a little, it turned to be working.
Following is the change.

--- a/tools/libxl/libxl_aoutils.c
+++ b/tools/libxl/libxl_aoutils.c
@@ -89,7 +89,8 @@ void libxl__datacopier_prefixdata(libxl_

ÂÂÂÂ assert(len < dc->maxsz - dc->used);

-ÂÂÂ buf = libxl__zalloc(NOGC, sizeof(*buf) - sizeof(buf->buf) + len);
+//ÂÂÂ buf = libxl__zalloc(NOGC, sizeof(*buf) - sizeof(buf->buf) + len);
+ÂÂÂ buf = libxl__zalloc(NOGC, sizeof(libxl__datacopier_buf));
ÂÂÂÂ buf->used = len;
ÂÂÂÂ memcpy(buf->buf, data, len);

@@ -141,10 +142,11 @@ static void datacopier_readable(libxl__e
ÂÂÂÂÂÂÂÂ libxl__datacopier_buf *buf =
ÂÂÂÂÂÂÂÂÂÂÂÂ LIBXL_TAILQ_LAST(&dc->bufs, libxl__datacopier_bufs);
ÂÂÂÂÂÂÂÂ if (!buf || buf->used >= sizeof(buf->buf)) {
-ÂÂÂÂÂÂÂÂÂÂÂ buf = malloc(sizeof(*buf));
-ÂÂÂÂÂÂÂÂÂÂÂ if (!buf) libxl__alloc_failed(CTX, __func__, 1, sizeof(*buf));
-ÂÂÂÂÂÂÂÂÂÂÂ buf->used = 0;
-ÂÂÂÂÂÂÂÂÂÂÂ LIBXL_TAILQ_INSERT_TAIL(&dc->bufs, buf, entry);
+ÂÂÂÂÂÂÂÂÂÂÂ libxl__datacopier_buf *newbuf = malloc(sizeof(libxl__datacopier_buf));
+ÂÂÂÂÂÂÂÂÂÂÂ if (!newbuf) libxl__alloc_failed(CTX, __func__, 1, sizeof(libxl__datacopier_buf));
+ÂÂÂÂÂÂÂÂÂÂÂ newbuf->used = 0;
+ÂÂÂÂÂÂÂÂÂÂÂ LIBXL_TAILQ_INSERT_TAIL(&dc->bufs, newbuf, entry);
+ÂÂÂÂÂÂÂÂÂÂÂ buf = newbuf;
ÂÂÂÂÂÂÂÂ }
ÂÂÂÂÂÂÂÂ int r = read(ev->fd,
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ buf->buf + buf->used,


Could anybody familiar with this part of code take a look at it?

Thanks,
Chunyan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel