qemu: fix restoring a compressed save image

Latent bug introduced in commit 2d6a581960 (Aug 2009), but not exposed
until commit 1859939a (Jan 2011).  Basically, when virExec creates a
pipe, it always marks libvirt's side as cloexec.  If libvirt then
wants to hand that pipe to another child process, things work great if
the fd is dup2()'d onto stdin or stdout (as with stdin: or exec:
migration), but if the pipe is instead used as-is (such as with fd:
migration) then qemu sees EBADF because the fd was closed at exec().

This is a minimal fix for the problem at hand; it is slightly racy,
but no more racy than the rest of libvirt fd handling, including the
case of uncompressed save images.  A more invasive fix, but ultimately
safer at avoiding leaking unintended fds, would be to _always and
atomically_ open all fds as cloexec in libvirt (thanks to primitives
like open(O_CLOEXEC), pipe2(), accept4(), ...), then teach virExec to
clear that bit for all fds explicitly marked to be handed to the child
only after forking.

* src/qemu/qemu_command.c (qemuBuildCommandLine): Clear cloexec
flag.
* tests/qemuxml2argvtest.c (testCompareXMLToArgvFiles): Tweak test.

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index c9b985007777bdfb6617ff16d78dbd34a8699f38..313894357dc172810d5fbc9cdf157dff6a39e035 100644 (file)
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -4329,6 +4329,14 @@ qemuBuildCommandLine(virConnectPtr conn,
         } else if (STREQ(migrateFrom, "stdio")) {
             if (qemuCapsGet(qemuCaps, QEMU_CAPS_MIGRATE_QEMU_FD)) {
                 virCommandAddArgFormat(cmd, "fd:%d", migrateFd);
+                /* migrateFd might be cloexec, but qemu must inherit
+                 * it if vmop indicates qemu will be executed */
+                if (vmop != VIR_VM_OP_NO_OP &&
+                    virSetInherit(migrateFd, true) < 0) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("Failed to clear cloexec flag"));
+                    goto error;
+                }
                 virCommandPreserveFD(cmd, migrateFd);
             } else if (qemuCapsGet(qemuCaps, QEMU_CAPS_MIGRATE_QEMU_EXEC)) {
                 virCommandAddArg(cmd, "exec:cat");
@@ -4358,6 +4366,14 @@ qemuBuildCommandLine(virConnectPtr conn,
                 goto error;
             }
             virCommandAddArg(cmd, migrateFrom);
+            /* migrateFd might be cloexec, but qemu must inherit
+             * it if vmop indicates qemu will be executed */
+            if (vmop != VIR_VM_OP_NO_OP &&
+                virSetInherit(migrateFd, true) < 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Failed to clear cloexec flag"));
+                goto error;
+            }
             virCommandPreserveFD(cmd, migrateFd);
         } else if (STRPREFIX(migrateFrom, "unix")) {
             if (!qemuCapsGet(qemuCaps, QEMU_CAPS_MIGRATE_QEMU_UNIX)) {

diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index c1329faf138a028394665016ba314860cdb58b82..02de8de1a61140844121295c55c9b8a60d26cea8 100644 (file)
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -122,7 +122,7 @@ static int testCompareXMLToArgvFiles(const char *xml,
     if (!(cmd = qemuBuildCommandLine(conn, &driver,
                                      vmdef, &monitor_chr, false, extraFlags,
                                      migrateFrom, migrateFd, NULL,
-                                     VIR_VM_OP_CREATE)))
+                                     VIR_VM_OP_NO_OP)))
         goto fail;
 
     if (!!virGetLastError() != expectError) {