2009-05-13 00:45:14 +08:00
|
|
|
/*
|
|
|
|
* eventtest.c: Test the libvirtd event loop impl
|
|
|
|
*
|
2014-10-29 02:38:04 +08:00
|
|
|
* Copyright (C) 2009, 2011-2014 Red Hat, Inc.
|
2009-05-13 00:45:14 +08:00
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
2012-09-21 06:30:55 +08:00
|
|
|
* License along with this library. If not, see
|
2012-07-21 18:06:23 +08:00
|
|
|
* <http://www.gnu.org/licenses/>.
|
2009-05-13 00:45:14 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
|
|
|
#include <signal.h>
|
|
|
|
#include <time.h>
|
|
|
|
|
2020-09-01 19:27:44 +08:00
|
|
|
#if WITH_MACH_CLOCK_ROUTINES
|
2016-11-20 01:42:27 +08:00
|
|
|
# include <mach/clock.h>
|
|
|
|
# include <mach/mach.h>
|
|
|
|
#endif
|
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
#include "testutils.h"
|
|
|
|
#include "internal.h"
|
2013-05-10 02:59:04 +08:00
|
|
|
#include "virfile.h"
|
2012-12-13 01:59:27 +08:00
|
|
|
#include "virlog.h"
|
2012-12-14 01:44:57 +08:00
|
|
|
#include "virutil.h"
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2014-02-28 20:16:17 +08:00
|
|
|
VIR_LOG_INIT("tests.eventtest");
|
|
|
|
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
#define NUM_FDS 31
|
|
|
|
#define NUM_TIME 31
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
static pthread_mutex_t eventThreadMutex = PTHREAD_MUTEX_INITIALIZER;
|
|
|
|
static pthread_cond_t eventThreadCond = PTHREAD_COND_INITIALIZER;
|
2020-02-06 20:00:25 +08:00
|
|
|
static bool eventThreadSignaled;
|
2020-01-17 18:55:48 +08:00
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
static struct handleInfo {
|
|
|
|
int pipeFD[2];
|
|
|
|
int fired;
|
|
|
|
int watch;
|
|
|
|
int error;
|
|
|
|
int delete;
|
|
|
|
} handles[NUM_FDS];
|
|
|
|
|
|
|
|
static struct timerInfo {
|
|
|
|
int timeout;
|
|
|
|
int timer;
|
|
|
|
int fired;
|
|
|
|
int error;
|
|
|
|
int delete;
|
|
|
|
} timers[NUM_TIME];
|
|
|
|
|
|
|
|
enum {
|
|
|
|
EV_ERROR_NONE,
|
|
|
|
EV_ERROR_WATCH,
|
|
|
|
EV_ERROR_FD,
|
|
|
|
EV_ERROR_EVENT,
|
|
|
|
EV_ERROR_DATA,
|
|
|
|
};
|
|
|
|
|
2015-09-29 22:55:22 +08:00
|
|
|
struct testEventResultData {
|
|
|
|
bool failed;
|
|
|
|
const char *msg;
|
|
|
|
};
|
|
|
|
|
|
|
|
static int
|
|
|
|
testEventResultCallback(const void *opaque)
|
|
|
|
{
|
|
|
|
const struct testEventResultData *data = opaque;
|
|
|
|
|
|
|
|
if (data->failed && data->msg)
|
|
|
|
fprintf(stderr, "%s", data->msg);
|
|
|
|
return data->failed;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
2019-10-15 19:35:07 +08:00
|
|
|
G_GNUC_PRINTF(3, 4)
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(const char *name, bool failed, const char *msg, ...)
|
|
|
|
{
|
|
|
|
va_list vargs;
|
2021-09-05 04:37:44 +08:00
|
|
|
g_autofree char *str = NULL;
|
2015-09-29 22:55:22 +08:00
|
|
|
struct testEventResultData data;
|
|
|
|
|
2020-08-03 23:27:58 +08:00
|
|
|
va_start(vargs, msg);
|
|
|
|
|
2019-10-22 20:11:15 +08:00
|
|
|
if (msg)
|
|
|
|
str = g_strdup_vprintf(msg, vargs);
|
2015-09-29 22:55:22 +08:00
|
|
|
|
|
|
|
data.failed = failed;
|
|
|
|
data.msg = str;
|
2016-05-26 23:01:50 +08:00
|
|
|
ignore_value(virTestRun(name, testEventResultCallback, &data));
|
2015-09-29 22:55:22 +08:00
|
|
|
|
|
|
|
va_end(vargs);
|
|
|
|
}
|
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
static void
|
|
|
|
testPipeReader(int watch, int fd, int events, void *data)
|
|
|
|
{
|
|
|
|
struct handleInfo *info = data;
|
|
|
|
char one;
|
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
VIR_DEBUG("Handle callback watch=%d fd=%d ev=%d", watch, fd, events);
|
|
|
|
pthread_mutex_lock(&eventThreadMutex);
|
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
info->fired = 1;
|
|
|
|
|
|
|
|
if (watch != info->watch) {
|
|
|
|
info->error = EV_ERROR_WATCH;
|
2020-01-17 18:55:48 +08:00
|
|
|
goto cleanup;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (fd != info->pipeFD[0]) {
|
|
|
|
info->error = EV_ERROR_FD;
|
2020-01-17 18:55:48 +08:00
|
|
|
goto cleanup;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!(events & VIR_EVENT_HANDLE_READABLE)) {
|
|
|
|
info->error = EV_ERROR_EVENT;
|
2020-01-17 18:55:48 +08:00
|
|
|
goto cleanup;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
if (read(fd, &one, 1) != 1) {
|
|
|
|
info->error = EV_ERROR_DATA;
|
2020-01-17 18:55:48 +08:00
|
|
|
goto cleanup;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
info->error = EV_ERROR_NONE;
|
|
|
|
|
|
|
|
if (info->delete != -1)
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveHandle(info->delete);
|
2020-01-17 18:55:48 +08:00
|
|
|
|
|
|
|
cleanup:
|
|
|
|
pthread_cond_signal(&eventThreadCond);
|
2020-02-06 20:00:25 +08:00
|
|
|
eventThreadSignaled = true;
|
|
|
|
pthread_mutex_unlock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
testTimer(int timer, void *data)
|
|
|
|
{
|
|
|
|
struct timerInfo *info = data;
|
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
VIR_DEBUG("Timer callback timer=%d", timer);
|
|
|
|
pthread_mutex_lock(&eventThreadMutex);
|
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
info->fired = 1;
|
|
|
|
|
|
|
|
if (timer != info->timer) {
|
|
|
|
info->error = EV_ERROR_WATCH;
|
2020-01-17 18:55:48 +08:00
|
|
|
goto cleanup;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
info->error = EV_ERROR_NONE;
|
|
|
|
|
|
|
|
if (info->delete != -1)
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveTimeout(info->delete);
|
2020-01-17 18:55:48 +08:00
|
|
|
|
|
|
|
cleanup:
|
|
|
|
pthread_cond_signal(&eventThreadCond);
|
2020-02-06 20:00:25 +08:00
|
|
|
eventThreadSignaled = true;
|
|
|
|
pthread_mutex_unlock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
G_GNUC_NORETURN static void *eventThreadLoop(void *data G_GNUC_UNUSED) {
|
|
|
|
while (1)
|
|
|
|
virEventRunDefaultImpl();
|
|
|
|
abort();
|
|
|
|
}
|
2009-05-13 00:45:14 +08:00
|
|
|
|
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
static void
|
|
|
|
waitEvents(int nhandle, int ntimer)
|
|
|
|
{
|
|
|
|
int ngothandle = 0;
|
|
|
|
int ngottimer = 0;
|
|
|
|
size_t i;
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
VIR_DEBUG("Wait events nhandle %d ntimer %d",
|
|
|
|
nhandle, ntimer);
|
|
|
|
while (ngothandle != nhandle || ngottimer != ntimer) {
|
2020-02-06 20:00:25 +08:00
|
|
|
while (!eventThreadSignaled)
|
|
|
|
pthread_cond_wait(&eventThreadCond, &eventThreadMutex);
|
|
|
|
|
|
|
|
eventThreadSignaled = false;
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
ngothandle = ngottimer = 0;
|
|
|
|
for (i = 0; i < NUM_FDS; i++) {
|
|
|
|
if (handles[i].fired)
|
|
|
|
ngothandle++;
|
|
|
|
}
|
|
|
|
for (i = 0; i < NUM_TIME; i++) {
|
|
|
|
if (timers[i].fired)
|
|
|
|
ngottimer++;
|
|
|
|
}
|
|
|
|
|
|
|
|
VIR_DEBUG("Wait events ngothandle %d ngottimer %d",
|
|
|
|
ngothandle, ngottimer);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
2020-01-17 18:55:48 +08:00
|
|
|
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
2009-12-01 03:01:31 +08:00
|
|
|
verifyFired(const char *name, int handle, int timer)
|
2009-05-13 00:45:14 +08:00
|
|
|
{
|
|
|
|
int handleFired = 0;
|
|
|
|
int timerFired = 0;
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
size_t i;
|
2020-01-17 18:55:48 +08:00
|
|
|
VIR_DEBUG("Verify fired handle %d timer %d", handle, timer);
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_FDS; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
if (handles[i].fired) {
|
|
|
|
if (i != handle) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
"Handle %zu fired, but expected %d\n", i,
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
handle);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
} else {
|
|
|
|
if (handles[i].error != EV_ERROR_NONE) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
"Handle %zu fired, but had error %d\n", i,
|
2009-12-01 03:01:31 +08:00
|
|
|
handles[i].error);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
handleFired = 1;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
if (i == handle) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
"Handle %d should have fired, but didn't\n",
|
|
|
|
handle);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (handleFired != 1 && handle != -1) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
"Something weird happened, expecting handle %d\n",
|
|
|
|
handle);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_TIME; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
if (timers[i].fired) {
|
|
|
|
if (i != timer) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
"Timer %zu fired, but expected %d\n", i, timer);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
} else {
|
|
|
|
if (timers[i].error != EV_ERROR_NONE) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
"Timer %zu fired, but had error %d\n", i,
|
2009-12-01 03:01:31 +08:00
|
|
|
timers[i].error);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
timerFired = 1;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
if (i == timer) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
"Timer %d should have fired, but didn't\n",
|
|
|
|
timer);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (timerFired != 1 && timer != -1) {
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 1,
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
"Something weird happened, expecting timer %d\n",
|
|
|
|
timer);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
return EXIT_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
2009-12-01 03:01:31 +08:00
|
|
|
finishJob(const char *name, int handle, int timer)
|
2009-05-13 00:45:14 +08:00
|
|
|
{
|
2020-01-17 18:55:48 +08:00
|
|
|
pthread_mutex_lock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2020-01-17 18:55:48 +08:00
|
|
|
waitEvents(handle == -1 ? 0 : 1,
|
|
|
|
timer == -1 ? 0 : 1);
|
|
|
|
|
|
|
|
if (verifyFired(name, handle, timer) != EXIT_SUCCESS) {
|
|
|
|
pthread_mutex_unlock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
2020-01-17 18:55:48 +08:00
|
|
|
}
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2015-09-29 22:55:22 +08:00
|
|
|
testEventReport(name, 0, NULL);
|
2020-01-17 18:55:48 +08:00
|
|
|
|
|
|
|
pthread_mutex_unlock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
resetAll(void)
|
|
|
|
{
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
size_t i;
|
2020-01-17 18:55:48 +08:00
|
|
|
pthread_mutex_lock(&eventThreadMutex);
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_FDS; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
handles[i].fired = 0;
|
|
|
|
handles[i].error = EV_ERROR_NONE;
|
|
|
|
}
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_TIME; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
timers[i].fired = 0;
|
|
|
|
timers[i].error = EV_ERROR_NONE;
|
|
|
|
}
|
2020-01-17 18:55:48 +08:00
|
|
|
pthread_mutex_unlock(&eventThreadMutex);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2011-04-30 00:21:20 +08:00
|
|
|
mymain(void)
|
2009-05-13 00:45:14 +08:00
|
|
|
{
|
Convert 'int i' to 'size_t i' in tests/ files
Convert the type of loop iterators named 'i', 'j', k',
'ii', 'jj', 'kk', to be 'size_t' instead of 'int' or
'unsigned int', also santizing 'ii', 'jj', 'kk' to use
the normal 'i', 'j', 'k' naming
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-07-08 22:09:33 +08:00
|
|
|
size_t i;
|
2009-05-13 00:45:14 +08:00
|
|
|
pthread_t eventThread;
|
|
|
|
char one = '1';
|
2020-08-03 23:27:58 +08:00
|
|
|
char *debugEnv = getenv("LIBVIRT_DEBUG");
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_FDS; i++) {
|
2020-01-24 23:22:12 +08:00
|
|
|
if (virPipeQuiet(handles[i].pipeFD) < 0) {
|
2009-05-13 00:45:14 +08:00
|
|
|
fprintf(stderr, "Cannot create pipe: %d", errno);
|
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-21 21:35:37 +08:00
|
|
|
if (debugEnv && *debugEnv &&
|
|
|
|
(virLogSetDefaultPriority(virLogParseDefaultPriority(debugEnv)) < 0)) {
|
2009-08-06 21:55:07 +08:00
|
|
|
fprintf(stderr, "Invalid log level setting.\n");
|
|
|
|
return EXIT_FAILURE;
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRegisterDefaultImpl();
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_FDS; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
handles[i].delete = -1;
|
|
|
|
handles[i].watch =
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventAddHandle(handles[i].pipeFD[0],
|
|
|
|
VIR_EVENT_HANDLE_READABLE,
|
|
|
|
testPipeReader,
|
|
|
|
&handles[i], NULL);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_TIME; i++) {
|
2009-05-13 00:45:14 +08:00
|
|
|
timers[i].delete = -1;
|
|
|
|
timers[i].timeout = -1;
|
|
|
|
timers[i].timer =
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventAddTimeout(timers[i].timeout,
|
|
|
|
testTimer,
|
|
|
|
&timers[i], NULL);
|
2009-05-13 00:45:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
pthread_create(&eventThread, NULL, eventThreadLoop, NULL);
|
|
|
|
|
|
|
|
/* First time, is easy - just try triggering one of our
|
|
|
|
* registered handles */
|
2009-09-04 00:25:03 +08:00
|
|
|
if (safewrite(handles[1].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Simple write", 1, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Now lets delete one before starting poll(), and
|
|
|
|
* try triggering another handle */
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveHandle(handles[0].watch);
|
2009-09-04 00:25:03 +08:00
|
|
|
if (safewrite(handles[1].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted before poll", 1, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Next lets delete *during* poll, which should interrupt
|
|
|
|
* the loop with no event showing */
|
|
|
|
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveHandle(handles[1].watch);
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Interrupted during poll", -1, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Getting more fun, lets delete a later handle during dispatch */
|
|
|
|
|
|
|
|
handles[2].delete = handles[3].watch;
|
2009-09-04 00:25:03 +08:00
|
|
|
if (safewrite(handles[2].pipeFD[1], &one, 1) != 1
|
|
|
|
|| safewrite(handles[3].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted during dispatch", 2, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Extreme fun, lets delete ourselves during dispatch */
|
|
|
|
handles[2].delete = handles[2].watch;
|
2009-09-04 00:25:03 +08:00
|
|
|
if (safewrite(handles[2].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted during dispatch", 2, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Run a timer on its own */
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[1].timer, 100);
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Firing a timer", -1, 1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[1].timer, -1);
|
2009-05-13 00:45:14 +08:00
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Now lets delete one before starting poll(), and
|
|
|
|
* try triggering another timer */
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[1].timer, 100);
|
|
|
|
virEventRemoveTimeout(timers[0].timer);
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted before poll", -1, 1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[1].timer, -1);
|
2009-05-13 00:45:14 +08:00
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Next lets delete *during* poll, which should interrupt
|
|
|
|
* the loop with no event showing */
|
|
|
|
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveTimeout(timers[1].timer);
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Interrupted during poll", -1, -1) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Getting more fun, lets delete a later timer during dispatch */
|
|
|
|
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[2].timer, 100);
|
|
|
|
virEventUpdateTimeout(timers[3].timer, 100);
|
2009-05-13 00:45:14 +08:00
|
|
|
timers[2].delete = timers[3].timer;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted during dispatch", -1, 2) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[2].timer, -1);
|
2009-05-13 00:45:14 +08:00
|
|
|
|
|
|
|
resetAll();
|
|
|
|
|
|
|
|
/* Extreme fun, lets delete ourselves during dispatch */
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventUpdateTimeout(timers[2].timer, 100);
|
2009-05-13 00:45:14 +08:00
|
|
|
timers[2].delete = timers[2].timer;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Deleted during dispatch", -1, 2) != EXIT_SUCCESS)
|
2009-05-13 00:45:14 +08:00
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_FDS - 1; i++)
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveHandle(handles[i].watch);
|
2013-05-21 15:53:48 +08:00
|
|
|
for (i = 0; i < NUM_TIME - 1; i++)
|
2020-01-16 19:56:28 +08:00
|
|
|
virEventRemoveTimeout(timers[i].timer);
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2009-08-25 00:27:55 +08:00
|
|
|
resetAll();
|
|
|
|
|
event: fix event-handling allocation crash
Regression introduced in commit e6b68d7 (Nov 2010).
Prior to that point, handlesAlloc was always a multiple of
EVENT_ALLOC_EXTENT (10), and was an int (so even if the subtraction
had been able to wrap, a negative value would be less than the count
not try to free the handles array). But after that point,
VIR_RESIZE_N made handlesAlloc grow geometrically (with a pattern of
10, 20, 30, 45 for the handles array) but still freed in multiples of
EVENT_ALLOC_EXTENT; and the count changed to size_t. Which means that
after 31 handles have been created, then 30 handles destroyed,
handlesAlloc is 5 while handlesCount is 1, and since (size_t)(1 - 5)
is indeed greater than 1, this then tried to free 10 elements, which
had the awful effect of nuking the handles array while there were
still live handles.
Nuking live handles puts libvirtd in an inconsistent state, and was
easily reproducible by starting and then stopping 60 faqemu guests.
* daemon/event.c (virEventCleanupTimeouts, virEventCleanupHandles):
Avoid integer wrap-around causing us to delete the entire array
while entries are still active.
* tests/eventtest.c (mymain): Expose the bug.
2011-01-22 03:57:03 +08:00
|
|
|
/* Make sure the last handle still works several times in a row. */
|
|
|
|
for (i = 0; i < 4; i++) {
|
|
|
|
if (safewrite(handles[NUM_FDS - 1].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
|
|
|
if (finishJob("Simple write", NUM_FDS - 1, -1) != EXIT_SUCCESS)
|
|
|
|
return EXIT_FAILURE;
|
|
|
|
|
|
|
|
resetAll();
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-08-25 00:27:55 +08:00
|
|
|
/* Final test, register same FD twice, once with no
|
|
|
|
* events, and make sure the right callback runs */
|
|
|
|
handles[0].pipeFD[0] = handles[1].pipeFD[0];
|
|
|
|
handles[0].pipeFD[1] = handles[1].pipeFD[1];
|
|
|
|
|
2020-01-16 19:56:28 +08:00
|
|
|
handles[0].watch = virEventAddHandle(handles[0].pipeFD[0],
|
|
|
|
0,
|
|
|
|
testPipeReader,
|
|
|
|
&handles[0], NULL);
|
|
|
|
handles[1].watch = virEventAddHandle(handles[1].pipeFD[0],
|
|
|
|
VIR_EVENT_HANDLE_READABLE,
|
|
|
|
testPipeReader,
|
|
|
|
&handles[1], NULL);
|
2020-01-17 18:55:48 +08:00
|
|
|
|
2009-09-04 00:25:03 +08:00
|
|
|
if (safewrite(handles[1].pipeFD[1], &one, 1) != 1)
|
|
|
|
return EXIT_FAILURE;
|
2009-12-01 03:01:31 +08:00
|
|
|
if (finishJob("Write duplicate", 1, -1) != EXIT_SUCCESS)
|
2009-08-25 00:27:55 +08:00
|
|
|
return EXIT_FAILURE;
|
2009-05-13 00:45:14 +08:00
|
|
|
|
2017-04-27 14:47:19 +08:00
|
|
|
/* pthread_kill(eventThread, SIGTERM); */
|
2009-05-13 00:45:14 +08:00
|
|
|
|
|
|
|
return EXIT_SUCCESS;
|
|
|
|
}
|
|
|
|
|
2017-03-29 22:45:42 +08:00
|
|
|
VIR_TEST_MAIN(mymain)
|