[Qemu-devel] virtio-scsi WRITE_VERIFY crash

[Qemu-devel] virtio-scsi WRITE_VERIFY crash

[Venkatesh Srinivas]

Hi,

When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
command has no IOCB.

The callpath is:
scsi_dma_complete
dma_complete
dma_bdrv_cb
dma_bdrv_io
dma_bdrv_read
scsi_do_read
bdrv_co_em_bh
aio_bh_poll
aio_poll.

At the assertion, we have a zero-element iovector and the request has
a status of -1.

-- vs;

Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash

[Stefan Hajnoczi]

On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
> command has no IOCB.
> 
> The callpath is:
> scsi_dma_complete
> dma_complete
> dma_bdrv_cb
> dma_bdrv_io
> dma_bdrv_read
> scsi_do_read
> bdrv_co_em_bh
> aio_bh_poll
> aio_poll.
> 
> At the assertion, we have a zero-element iovector and the request has
> a status of -1.

CCing Paolo Bonzini and Asias He.  See the ./MAINTAINERS file to find
people that can help with specific QEMU subsystems.

It would be nice to include a full gdb backtrace when possible since
that may include extra information like that value of arguments in the
call stack.

Stefan

Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash

[ronnie sahlberg]

I dont think QEMU scsi emulation supports WRITE_VERIFY.

In the past there was a few instances where the code in the SCSI emulation
that determines the transfer direction, based on the opcode,  did not contain
a new opcode, so it got the xfer direction wrong and crashed.

I dont have access to my box with QEMU right now,
but I would check if it is something similar to this patch :

http://lists.gnu.org/archive/html/qemu-devel/2012-04/msg04130.html



regards
ronnie sahlberg


On Mon, Apr 8, 2013 at 8:53 AM, Stefan Hajnoczi <stefanha@gmail.com> wrote:
> On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
>> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
>> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
>> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
>> command has no IOCB.
>>
>> The callpath is:
>> scsi_dma_complete
>> dma_complete
>> dma_bdrv_cb
>> dma_bdrv_io
>> dma_bdrv_read
>> scsi_do_read
>> bdrv_co_em_bh
>> aio_bh_poll
>> aio_poll.
>>
>> At the assertion, we have a zero-element iovector and the request has
>> a status of -1.
>
> CCing Paolo Bonzini and Asias He.  See the ./MAINTAINERS file to find
> people that can help with specific QEMU subsystems.
>
> It would be nice to include a full gdb backtrace when possible since
> that may include extra information like that value of arguments in the
> call stack.
>
> Stefan
>

Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash

[Paolo Bonzini]

[-- Attachment #1: Type: text/plain, Size: 1014 bytes --]

Il 08/04/2013 17:53, Stefan Hajnoczi ha scritto:
> On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
>> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
>> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
>> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
>> command has no IOCB.
>>
>> The callpath is:
>> scsi_dma_complete
>> dma_complete
>> dma_bdrv_cb
>> dma_bdrv_io
>> dma_bdrv_read
>> scsi_do_read
>> bdrv_co_em_bh
>> aio_bh_poll
>> aio_poll.
>>
>> At the assertion, we have a zero-element iovector and the request has
>> a status of -1.
> 
> CCing Paolo Bonzini and Asias He.  See the ./MAINTAINERS file to find
> people that can help with specific QEMU subsystems.
> 
> It would be nice to include a full gdb backtrace when possible since
> that may include extra information like that value of arguments in the
> call stack.

The bug should actually be quite trivial, but I will only test the
attached patch tomorrow.

Thanks,

Paolo


[-- Attachment #2: 0001-scsi-avoid-assertion-failure-on-VERIFY-command.patch --]
[-- Type: text/x-patch, Size: 1896 bytes --]

>From 38d68bdee0d4cc75527da963e3b66a67aa0aadcc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Apr 2013 18:50:15 +0200
Subject: [PATCH] scsi: avoid assertion failure on VERIFY command

A verify command is not an actual read (we do not implement
compare mode) and thus does not have an AIOCB attached.  Do
not crash in scsi_dma_complete.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi-disk.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index c5c7bf3..068d9bb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -244,14 +244,15 @@ done:
     }
 }
 
-static void scsi_dma_complete(void *opaque, int ret)
+static void scsi_dma_complete_noio(void *opaque, int ret)
 {
     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
 
-    assert(r->req.aiocb != NULL);
-    r->req.aiocb = NULL;
-    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+    if (r->req.aiocb != NULL) {
+        r->req.aiocb = NULL;
+        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+    }
     if (r->req.io_canceled) {
         goto done;
     }
@@ -277,6 +278,14 @@ done:
     }
 }
 
+static void scsi_dma_complete(void *opaque, int ret)
+{
+    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+
+    assert(r->req.aiocb != NULL);
+    scsi_dma_complete_noio(opaque, ret);
+}
+
 static void scsi_read_complete(void * opaque, int ret)
 {
     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
@@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req)
     if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
         r->req.cmd.buf[0] == VERIFY_16) {
         if (r->req.sg) {
-            scsi_dma_complete(r, 0);
+            scsi_dma_complete_noio(r, 0);
         } else {
             scsi_write_complete(r, 0);
         }
-- 
1.8.2