From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: Endless loop in qcow2_alloc_cluster_offset Date: Mon, 07 Dec 2009 17:04:14 +0200 Message-ID: <4B1D196E.9060902@redhat.com> References: <4B0537EB.4000909@siemens.com> <4B055AEF.4030406@redhat.com> <4B055D32.3040601@siemens.com> <4B1D0E34.6070907@siemens.com> <4B1D1618.2080900@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Cc: Kevin Wolf , qemu-devel , kvm To: Jan Kiszka Return-path: Received: from mx1.redhat.com ([209.132.183.28]:16632 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932584AbZLGPEP (ORCPT ); Mon, 7 Dec 2009 10:04:15 -0500 In-Reply-To: <4B1D1618.2080900@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: On 12/07/2009 04:50 PM, Jan Kiszka wrote: > > Maybe I'm seeing ghosts, and I don't even have a minimal clue about what > goes on in the code, but this looks fishy: > > Plenty of ghosts in qcow2, of all those explorers who tried to brave the code. Only Kevin has ever come back. > preallocate() invokes qcow2_alloc_cluster_offset() passing&meta, a > stack variable. It seems that qcow2_alloc_cluster_offset() may insert > this structure into cluster_allocs and leave it there. So we corrupt the > queue as soon as preallocate() returns, no? > > We invoke run_dependent_requests() which should dequeue those &meta again (I think). -- error compiling committee.c: too many arguments to function From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NHf8W-00087U-Ek for qemu-devel@nongnu.org; Mon, 07 Dec 2009 10:04:28 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NHf8P-00081U-7A for qemu-devel@nongnu.org; Mon, 07 Dec 2009 10:04:27 -0500 Received: from [199.232.76.173] (port=60159 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NHf8P-00081C-0A for qemu-devel@nongnu.org; Mon, 07 Dec 2009 10:04:21 -0500 Received: from mx1.redhat.com ([209.132.183.28]:6758) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NHf8N-0007AU-DH for qemu-devel@nongnu.org; Mon, 07 Dec 2009 10:04:20 -0500 Message-ID: <4B1D196E.9060902@redhat.com> Date: Mon, 07 Dec 2009 17:04:14 +0200 From: Avi Kivity MIME-Version: 1.0 References: <4B0537EB.4000909@siemens.com> <4B055AEF.4030406@redhat.com> <4B055D32.3040601@siemens.com> <4B1D0E34.6070907@siemens.com> <4B1D1618.2080900@siemens.com> In-Reply-To: <4B1D1618.2080900@siemens.com> Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] Re: Endless loop in qcow2_alloc_cluster_offset List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jan Kiszka Cc: Kevin Wolf , qemu-devel , kvm On 12/07/2009 04:50 PM, Jan Kiszka wrote: > > Maybe I'm seeing ghosts, and I don't even have a minimal clue about what > goes on in the code, but this looks fishy: > > Plenty of ghosts in qcow2, of all those explorers who tried to brave the code. Only Kevin has ever come back. > preallocate() invokes qcow2_alloc_cluster_offset() passing&meta, a > stack variable. It seems that qcow2_alloc_cluster_offset() may insert > this structure into cluster_allocs and leave it there. So we corrupt the > queue as soon as preallocate() returns, no? > > We invoke run_dependent_requests() which should dequeue those &meta again (I think). -- error compiling committee.c: too many arguments to function