From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48173) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZxAij-000507-HC for qemu-devel@nongnu.org; Fri, 13 Nov 2015 04:32:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZxAii-0007Nr-Fz for qemu-devel@nongnu.org; Fri, 13 Nov 2015 04:32:37 -0500 From: Fam Zheng Date: Fri, 13 Nov 2015 17:32:20 +0800 Message-Id: <1447407140-24055-1-git-send-email-famz@redhat.com> Subject: [Qemu-devel] [PATCH] virtio-blk: Fix double completion for werror=stop List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , lvivier@redhat.com, qemu-block@nongnu.org, pl@kamp.de, qemu-stable@nongnu.org, Stefan Hajnoczi , dgibson@redhat.com When a request R is absorbed by request M, it is appended to the "mr_next" queue led by M, and is completed together with the completion of M, in virtio_blk_rw_complete. With error policy equals stop, if M has an I/O error, now R also gets prepended to the per device DMA restart queue, which will be retried when VM resumes. It leads to a double completion (in symptoms of memory corruption or use after free). Adding R to the queue is superfluous, only M needs to be in the queue. Fix this by marking request R as "merged" and skipping it in virtio_blk_handle_rw_error. Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng --- hw/block/virtio-blk.c | 9 +++++++-- include/hw/virtio/virtio-blk.h | 1 + 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index e70fccf..4871f2a 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -36,6 +36,7 @@ VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s) req->in_len = 0; req->next = NULL; req->mr_next = NULL; + req->merged = false; return req; } @@ -72,8 +73,11 @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error, VirtIOBlock *s = req->dev; if (action == BLOCK_ERROR_ACTION_STOP) { - req->next = s->rq; - s->rq = req; + /* Merged requests don't need to be restarted. */ + if (!req->merged) { + req->next = s->rq; + s->rq = req; + } } else if (action == BLOCK_ERROR_ACTION_REPORT) { virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR); block_acct_failed(blk_get_stats(s->blk), &req->acct); @@ -344,6 +348,7 @@ static inline void submit_requests(BlockBackend *blk, MultiReqBuffer *mrb, for (i = start + 1; i < start + num_reqs; i++) { qemu_iovec_concat(qiov, &mrb->reqs[i]->qiov, 0, mrb->reqs[i]->qiov.size); + mrb->reqs[i]->merged = true; mrb->reqs[i - 1]->mr_next = mrb->reqs[i]; nb_sectors += mrb->reqs[i]->qiov.size / BDRV_SECTOR_SIZE; } diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h index 6bf5905..db4adf4 100644 --- a/include/hw/virtio/virtio-blk.h +++ b/include/hw/virtio/virtio-blk.h @@ -70,6 +70,7 @@ typedef struct VirtIOBlockReq { size_t in_len; struct VirtIOBlockReq *next; struct VirtIOBlockReq *mr_next; + bool merged; BlockAcctCookie acct; } VirtIOBlockReq; -- 2.4.3