From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:36385)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1WrSTP-0003gq-6R
	for qemu-devel@nongnu.org; Mon, 02 Jun 2014 09:40:28 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1WrSTF-0004lH-5V
	for qemu-devel@nongnu.org; Mon, 02 Jun 2014 09:40:23 -0400
Date: Mon, 2 Jun 2014 15:40:07 +0200
From: Stefan Hajnoczi <stefanha@gmail.com>
Message-ID: <20140602134007.GG3049@stefanha-thinkpad.redhat.com>
References: <53863BC6.3040108@profihost.ag> <53863C9A.4040905@profihost.ag>
	<606EBA1F-638A-487D-8551-8D183D79937E@profihost.ag>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <606EBA1F-638A-487D-8551-8D183D79937E@profihost.ag>
Subject: Re: [Qemu-devel] qemu 2.0 segfaults in event notifier
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Priebe <s.priebe@profihost.ag>
Cc: "famz@redhat.com" <famz@redhat.com>, qemu-devel <qemu-devel@nongnu.org>, "qemu-stable@nongnu.org" <qemu-stable@nongnu.org>

On Fri, May 30, 2014 at 04:10:39PM +0200, Stefan Priebe wrote:
> even with
> +From 271c0f68b4eae72691721243a1c37f46a3232d61 Mon Sep 17 00:00:00 2001
> +From: Fam Zheng <famz@redhat.com>
> +Date: Wed, 21 May 2014 10:42:13 +0800
> +Subject: [PATCH] aio: Fix use-after-free in cancellation path
> 
> applied i saw today segfault with the following backtrace:
> 
> Program terminated with signal 11, Segmentation fault.
> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at util/event_notifier-posix.c:97
> 97      util/event_notifier-posix.c: No such file or directory.
> (gdb) bt
> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at util/event_notifier-posix.c:97
> #1  0x00007f9dd5f4eafc in aio_notify (ctx=0x0) at async.c:246
> #2  0x00007f9dd5f4e697 in qemu_bh_schedule (bh=0x7f9b98eeeb30) at async.c:128
> #3  0x00007f9dd5fa2c44 in rbd_finish_aiocb (c=0x7f9dd9069ad0, rcb=0x7f9dd85f1770) at block/rbd.c:585

Hi Stefan,
Please print the QEMUBH:
(gdb) p *(QEMUBH*)0x7f9b98eeeb30

It would also be interesting to print out the qemu_aio_context->first_bh
linked list of QEMUBH structs to check whether 0x7f9b98eeeb30 is on the
list.

The aio_bh_new() and aio_bh_schedule() APIs are supposed to be
thread-safe.  In theory the rbd.c code is fine.  But maybe there is a
race condition somewhere.

If you want to debug interactively, ping me on #qemu on irc.oftc.net.

Stefan