Re: [Qemu-devel] qemu crash in coroutine bdrv_co_do_rw

[Christian Borntraeger <borntraeger@de.ibm.com>]

Am 06.03.2015 um 18:23 schrieb Stefan Hajnoczi:
> On Thu, Feb 26, 2015 at 10:29:57AM +0100, Christian Borntraeger wrote:
>> is this some know issue? Under heavy load with lots of dataplane devices I sometimes get a segfault in the bdrc_co_do_rw routine:
>>
>> #0  bdrv_co_do_rw (opaque=0x0) at /home/cborntra/REPOS/qemu/block.c:4791
>> 4791	    if (!acb->is_write) {
>> (gdb) bt
>> #0  bdrv_co_do_rw (opaque=0x0) at /home/cborntra/REPOS/qemu/block.c:4791
>> #1  0x00000000801aeb78 in coroutine_trampoline (i0=<optimized out>, i1=-725099072) at /home/cborntra/REPOS/qemu/coroutine-ucontext.c:80
>> #2  0x000003fffbe1cca2 in __makecontext_ret () from /lib64/libc.so.6
>> Backtrace stopped: previous frame identical to this frame (corrupt stack?)
>> (gdb) up
>> #1  0x00000000801aeb78 in coroutine_trampoline (i0=<optimized out>, i1=-725099072) at /home/cborntra/REPOS/qemu/coroutine-ucontext.c:80
>> 80	        co->entry(co->entry_arg);
>> (gdb) print *co
>> $1 = {entry = 0x801a3c28 <bdrv_co_do_rw>, entry_arg = 0x0, caller = 0x3ffe2fff788, pool_next = {sle_next = 0x3ffd2287990}, co_queue_wakeup = {tqh_first = 0x0, 
>>     tqh_last = 0x3ffd4c7dde0}, co_queue_next = {tqe_next = 0x0, tqe_prev = 0x0}}
>>
>> As you can see enty_arg is 0, causing the problem. Do you have any quick idea before I start debugging?
> 
> No, I haven't seen this bug before.  Are you running qemu.git/master?
> 
> Have you tried disabling the coroutine pool (freelist)?
> 
> Stefan
> 

I was able to increase the likelyhood of hitting this (more vCPUs, less guests).

bisect thinks that this makes this shaky:

4d68e86bb10159099da0798f74e7512955f15eec is the first bad commit
commit 4d68e86bb10159099da0798f74e7512955f15eec
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Tue Dec 2 12:05:48 2014 +0100

    coroutine: rewrite pool to avoid mutex


Christian