[libvirt] [PATCH] rpc: Fix client crash when server drops connection

[Jiri Denemark]

Despite of the comment stating virNetClientIncomingEvent handler should
never be called with either client->haveTheBuck or client->wantClose
set, there is a sequence of events that may lead to both booleans being
true when virNetClientIncomingEvent is called. However, when that
happens, we must not immediately close the socket as there are other
threads waiting for the buck and they would cause SIGSEGV once they are
woken up after the socket was closed. Another thing is we should clear
all remaining calls in the queue after closing the socket.

The situation that can lead to the crash involves three threads, one of
them running event loop and the other two calling libvirt APIs. The
event loop threads detects an event on client->sock and calls
virNetClientIncomingEvent handler. But before the handler gets a chance
to lock client, the other two threads (T1 and T2) start calling some
APIs. T1 gets the buck and detects EOF on client->sock while processing
its RPC call. Since T2 is waiting for its own call, T1 passes the buck
onto it and unlocks client. But before T2 gets the signal, the event
loop thread wakes up, does its job and closes client->sock. The crash
happens when T2 actually wakes up and tries to do its job using a closed
client->sock.
---
 src/rpc/virnetclient.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 1379078..010c5c3 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1825,7 +1825,6 @@ void virNetClientIncomingEvent(virNetSocketPtr sock,
     if (!client->sock)
         goto done;
 
-    /* This should be impossible, but it doesn't hurt to check */
     if (client->haveTheBuck || client->wantClose)
         goto done;
 
@@ -1858,8 +1857,12 @@ void virNetClientIncomingEvent(virNetSocketPtr sock,
     virNetClientIOUpdateCallback(client, true);
 
 done:
-    if (client->wantClose)
+    if (client->wantClose && !client->haveTheBuck) {
         virNetClientCloseLocked(client);
+        virNetClientCallRemovePredicate(&client->waitDispatch,
+                                        virNetClientIOEventLoopRemoveAll,
+                                        NULL);
+    }
     virObjectUnlock(client);
 }
 
-- 
1.8.1.5