From mboxrd@z Thu Jan  1 00:00:00 1970
From: Conor Murphy <conor_murphy_virt@hotmail.com>
Subject: Re: qemu-kvm crash with
Date: Fri, 25 Mar 2011 08:52:58 +0000 (UTC)
Message-ID: <loom.20110325T094619-227@post.gmane.org>
References: <loom.20110324T124830-43@post.gmane.org> <20110324120310.GD32408@redhat.com> <loom.20110324T130857-15@post.gmane.org> <loom.20110324T143548-362@post.gmane.org> <AANLkTikSGHUYdbUg9_D_qc+vguzkZLcO0b7yfTNkLaLF@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To: kvm@vger.kernel.org
Return-path: <kvm-owner@vger.kernel.org>
Received: from lo.gmane.org ([80.91.229.12]:60847 "EHLO lo.gmane.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753631Ab1CYIxM (ORCPT <rfc822;kvm@vger.kernel.org>);
	Fri, 25 Mar 2011 04:53:12 -0400
Received: from list by lo.gmane.org with local (Exim 4.69)
	(envelope-from <gcekd-kvm-devel@m.gmane.org>)
	id 1Q32lb-0002QH-KN
	for kvm@vger.kernel.org; Fri, 25 Mar 2011 09:53:11 +0100
Received: from 95.45.199.134 ([95.45.199.134])
        by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
        id 1AlnuQ-0007hv-00
        for <kvm@vger.kernel.org>; Fri, 25 Mar 2011 09:53:11 +0100
Received: from conor_murphy_virt by 95.45.199.134 with local (Gmexim 0.1 (Debian))
        id 1AlnuQ-0007hv-00
        for <kvm@vger.kernel.org>; Fri, 25 Mar 2011 09:53:11 +0100
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

Hi,

The content of aiocb

(gdb) print *aiocb
$1 = {common = {pool = 0x9aced0, bs = 0x1270230, cb = 0x45591f <multiwrite_cb>,
 opaque = 0x7f54b0034f60, next = 0x0}, aio_fildes = 16, 
 {aio_iov = 0x7f54b006cd48, aio_ioctl_buf = 0x7f54b006cd48}, 
 aio_niov = 17, 
  aio_nbytes = 65024, ev_signo = 12, aio_offset = 1081344, 
 node = {tqe_next = 0x0, tqe_prev = 0x9f10a0}, 
  aio_type = 2, ret = -115, active = 1, next = 0x7f54b00409f0, 
 async_context_id = 0}

(gdb) print aiocb->aio_iov[0]
$2 = {iov_base = 0x7f54a9f141f8, iov_len = 3592}
(gdb) print aiocb->aio_iov[1]
$3 = {iov_base = 0x7f54a27d5000, iov_len = 4096}
(gdb) print aiocb->aio_iov[2]
$4 = {iov_base = 0x7f54a30d6000, iov_len = 4096}
(gdb) print aiocb->aio_iov[3]
$5 = {iov_base = 0x7f5433a57000, iov_len = 4096}
(gdb) print aiocb->aio_iov[5]
$6 = {iov_base = 0x7f54a2fd9000, iov_len = 4096}
(gdb) print aiocb->aio_iov[6]
$7 = {iov_base = 0x7f54a275a000, iov_len = 4096}
(gdb) print aiocb->aio_iov[7]
$8 = {iov_base = 0x7f54a2fdb000, iov_len = 4096}
(gdb) print aiocb->aio_iov[8]
$9 = {iov_base = 0x7f54ab55c000, iov_len = 4096}
(gdb) print aiocb->aio_iov[9]
$10 = {iov_base = 0x7f543639d000, iov_len = 4096}
(gdb) print aiocb->aio_iov[10]
$11 = {iov_base = 0x7f543115e000, iov_len = 4096}
(gdb) print aiocb->aio_iov[11]
$12 = {iov_base = 0x7f54361df000, iov_len = 4096}
(gdb) print aiocb->aio_iov[12]
$13 = {iov_base = 0x7f54a9620000, iov_len = 4096}
(gdb) print aiocb->aio_iov[13]
$14 = {iov_base = 0x7f54a23a1000, iov_len = 4096}
(gdb) print aiocb->aio_iov[14]
$15 = {iov_base = 0x7f54ae122000, iov_len = 4096}
(gdb) print aiocb->aio_iov[15]
$16 = {iov_base = 0x7f54312a3000, iov_len = 4096}
(gdb) print aiocb->aio_iov[16]
$17 = {iov_base = 0x7f54a28a4000, iov_len = 503}
(gdb) 

The one thing that seems odd is that the sum of iov_len is 65535 
which is > then aio_nbtyes of 65024

Does this mean the code ends up writing past the end of buf?

/Conor