Re: qemu-kvm crash with

[Conor Murphy <conor_murphy_virt@hotmail.com>]

Hi,

The content of aiocb

(gdb) print *aiocb
$1 = {common = {pool = 0x9aced0, bs = 0x1270230, cb = 0x45591f <multiwrite_cb>,
 opaque = 0x7f54b0034f60, next = 0x0}, aio_fildes = 16, 
 {aio_iov = 0x7f54b006cd48, aio_ioctl_buf = 0x7f54b006cd48}, 
 aio_niov = 17, 
  aio_nbytes = 65024, ev_signo = 12, aio_offset = 1081344, 
 node = {tqe_next = 0x0, tqe_prev = 0x9f10a0}, 
  aio_type = 2, ret = -115, active = 1, next = 0x7f54b00409f0, 
 async_context_id = 0}

(gdb) print aiocb->aio_iov[0]
$2 = {iov_base = 0x7f54a9f141f8, iov_len = 3592}
(gdb) print aiocb->aio_iov[1]
$3 = {iov_base = 0x7f54a27d5000, iov_len = 4096}
(gdb) print aiocb->aio_iov[2]
$4 = {iov_base = 0x7f54a30d6000, iov_len = 4096}
(gdb) print aiocb->aio_iov[3]
$5 = {iov_base = 0x7f5433a57000, iov_len = 4096}
(gdb) print aiocb->aio_iov[5]
$6 = {iov_base = 0x7f54a2fd9000, iov_len = 4096}
(gdb) print aiocb->aio_iov[6]
$7 = {iov_base = 0x7f54a275a000, iov_len = 4096}
(gdb) print aiocb->aio_iov[7]
$8 = {iov_base = 0x7f54a2fdb000, iov_len = 4096}
(gdb) print aiocb->aio_iov[8]
$9 = {iov_base = 0x7f54ab55c000, iov_len = 4096}
(gdb) print aiocb->aio_iov[9]
$10 = {iov_base = 0x7f543639d000, iov_len = 4096}
(gdb) print aiocb->aio_iov[10]
$11 = {iov_base = 0x7f543115e000, iov_len = 4096}
(gdb) print aiocb->aio_iov[11]
$12 = {iov_base = 0x7f54361df000, iov_len = 4096}
(gdb) print aiocb->aio_iov[12]
$13 = {iov_base = 0x7f54a9620000, iov_len = 4096}
(gdb) print aiocb->aio_iov[13]
$14 = {iov_base = 0x7f54a23a1000, iov_len = 4096}
(gdb) print aiocb->aio_iov[14]
$15 = {iov_base = 0x7f54ae122000, iov_len = 4096}
(gdb) print aiocb->aio_iov[15]
$16 = {iov_base = 0x7f54312a3000, iov_len = 4096}
(gdb) print aiocb->aio_iov[16]
$17 = {iov_base = 0x7f54a28a4000, iov_len = 503}
(gdb) 

The one thing that seems odd is that the sum of iov_len is 65535 
which is > then aio_nbtyes of 65024

Does this mean the code ends up writing past the end of buf?

/Conor