From: Jie Song <[email protected]> When starting a dummy QEMU process with virsh version, monitor_init_qmp() enables IOThread monitoring of the QMP fd by default. However, a race condition exists during the initialization phase: the IOThread only removes the main thread's fd watch when it reaches qio_net_listener_set_client_func_full(), which may be delayed under high system load.
This creates a window between monitor_qmp_setup_handlers_bh() and qio_net_listener_set_client_func_full() where both the main thread and IOThread are simultaneously monitoring the same fd and processing events. This race can cause either the main thread or the IOThread to hang and become unresponsive. This fix calls qio_net_listener_set_client_func_full to change the callback to NULL to destroy and unref all existing IO sources on the socket chardev listener before the IOThread initializes QMP monitoring, guaranteeing that no concurrent fd monitoring occurs during the transition to IOThread handling. Signed-off-by: Jie Song <[email protected]> --- Changes in v2: - Add the judgment of chrdev type, suggested by Daniel P . Berrangé - Use qio_net_listener_set_client_func_full, suggested by Eric Blake - Link to v1: https://lists.nongnu.org/archive/html/qemu-devel/2025-11/msg01621.html --- monitor/qmp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/monitor/qmp.c b/monitor/qmp.c index cb99a12d94..0f74298ddd 100644 --- a/monitor/qmp.c +++ b/monitor/qmp.c @@ -25,6 +25,8 @@ #include "qemu/osdep.h" #include "chardev/char-io.h" +#include "chardev/char-socket.h" +#include "io/net-listener.h" #include "monitor-internal.h" #include "qapi/error.h" #include "qapi/qapi-commands-control.h" @@ -537,6 +539,16 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp) * e.g. the chardev is in client mode, with wait=on. */ remove_fd_in_watch(chr); + /* + * Clean up SocketChardev listener IO sources early to prevent + * racy fd handling between the main thread and the I/O thread. + */ + if (object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_SOCKET)) { + SocketChardev *s = SOCKET_CHARDEV(chr); + if (s->listener) + qio_net_listener_set_client_func_full(s->listener, NULL, NULL, + NULL, chr->gcontext); + } /* * We can't call qemu_chr_fe_set_handlers() directly here * since chardev might be running in the monitor I/O -- 2.43.0
