Re: [Qemu-devel] qemu 2.0 segfaults in event notifier

[Stefan Hajnoczi <stefanha@gmail.com>]

On Fri, May 30, 2014 at 04:10:39PM +0200, Stefan Priebe wrote:
> even with
> +From 271c0f68b4eae72691721243a1c37f46a3232d61 Mon Sep 17 00:00:00 2001
> +From: Fam Zheng <famz@redhat.com>
> +Date: Wed, 21 May 2014 10:42:13 +0800
> +Subject: [PATCH] aio: Fix use-after-free in cancellation path
> 
> applied i saw today segfault with the following backtrace:
> 
> Program terminated with signal 11, Segmentation fault.
> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at util/event_notifier-posix.c:97
> 97      util/event_notifier-posix.c: No such file or directory.
> (gdb) bt
> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at util/event_notifier-posix.c:97
> #1  0x00007f9dd5f4eafc in aio_notify (ctx=0x0) at async.c:246
> #2  0x00007f9dd5f4e697 in qemu_bh_schedule (bh=0x7f9b98eeeb30) at async.c:128
> #3  0x00007f9dd5fa2c44 in rbd_finish_aiocb (c=0x7f9dd9069ad0, rcb=0x7f9dd85f1770) at block/rbd.c:585

Hi Stefan,
Please print the QEMUBH:
(gdb) p *(QEMUBH*)0x7f9b98eeeb30

It would also be interesting to print out the qemu_aio_context->first_bh
linked list of QEMUBH structs to check whether 0x7f9b98eeeb30 is on the
list.

The aio_bh_new() and aio_bh_schedule() APIs are supposed to be
thread-safe.  In theory the rbd.c code is fine.  But maybe there is a
race condition somewhere.

If you want to debug interactively, ping me on #qemu on irc.oftc.net.

Stefan