migration_incoming_state_destroy() NULLs all objects it frees after they
are freed, presumably so that a subsequent call to the same function
will not free them again, unless new objects have been created in the
meantime.
transport_data is the exception, and it shows exactly this problem: When
an incoming migration uses transport_cleanup() and transport_data, and a
subsequent incoming migration (e.g. loadvm) occurs that does not, then
when this second one is done, it will call transport_cleanup() on the
old transport_data again -- which has already been freed. This is
sometimes visible in the iotest 201, though for some reason I can only
reproduce it with -m32.
To fix this, call transport_cleanup() only when transport_data is not
NULL (otherwise there is nothing to clean up), and set transport_data to
NULL when it has been cleaned up (i.e. freed).
(transport_cleanup() is used only by migration/socket.c, where
socket_start_incoming_migration_internal() sets both it and
transport_data to non-NULL values.)
Signed-off-by: Hanna Reitz <hre...@redhat.com>
---
migration/migration.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/migration/migration.c b/migration/migration.c
index bcc385b94b..cdb2e76d02 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -287,8 +287,9 @@ void migration_incoming_state_destroy(void)
g_array_free(mis->postcopy_remote_fds, TRUE);
mis->postcopy_remote_fds = NULL;
}
- if (mis->transport_cleanup) {
+ if (mis->transport_cleanup && mis->transport_data) {
mis->transport_cleanup(mis->transport_data);
+ mis->transport_data = NULL;
}
qemu_event_reset(&mis->main_thread_load_event);
--
2.34.1
