From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35385) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eNJ4C-0003Ax-Hb for qemu-devel@nongnu.org; Fri, 08 Dec 2017 08:51:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eNJ49-00031y-FC for qemu-devel@nongnu.org; Fri, 08 Dec 2017 08:51:52 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57644) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eNJ49-000301-5t for qemu-devel@nongnu.org; Fri, 08 Dec 2017 08:51:49 -0500 Date: Fri, 8 Dec 2017 14:51:39 +0100 From: Kevin Wolf Message-ID: <20171208135139.GC4217@localhost.localdomain> References: <20171206091243.GC4207@localhost.localdomain> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="dc+cDN39EJAMEtIO" Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] About [PULL 20/25] block: Guard against NULL bs->drv List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Max Reitz Cc: Kangjie Xi , qemu-devel@nongnu.org, John Snow --dc+cDN39EJAMEtIO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Am 08.12.2017 um 14:39 hat Max Reitz geschrieben: > On 2017-12-06 10:12, Kevin Wolf wrote: > > Am 06.12.2017 um 08:28 hat Kangjie Xi geschrieben: > >> Hi, > >> > >> I encountered a qemu-nbd segfault, finally I found it was caused by > >> NULL bs-drv, which is located in block/io.c function bdrv_co_flush > >> line 2377: > >> > >> https://git.qemu.org/?p=3Dqemu.git;a=3Dblob;f=3Dblock/io.c;h=3D4fdf93a= 0144fa4761a14b8cc6b2a9a6b6e5d5bec;hb=3Dd470ad42acfc73c45d3e8ed5311a491160b4= c100#l2377 > >> > >> It is before the patch at line 2402, so the patch needs to be updated > >> to fix NULL bs-drv at line 2337. > >> > >> https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg03425.html > >=20 > > Can you please post a full backtrace? Do you see any error message > > on stderr before the process crashes? > >=20 > > I don't see at the moment how this can happen, except the case that Max > > mentioned where bs->drv =3D NULL is set when an image corruption is > > detected - this involves an error message, though. > >=20 > > We check bdrv_is_inserted() as the first thing, which includes a NULL > > check for bs->drv. So it must have been non-NULL at the start of the > > function and then become NULL. I suppose this can theoretically happen > > in qemu_co_queue_wait() if another flush request detects image > > corruption. > >=20 > > Max: I think bs->drv =3D NULL in the middle of a request was a stupid > > idea. In fact, it's already a stupid idea to have any BDS with > > bs->drv =3D NULL. Maybe it would be better to schedule a BH that replac= es > > the qcow2 node with a dummy node (null-co?) and properly closes the > > qcow2 one. >=20 > Yes, that is an idea John had, too. It sounded good to me (we'd just > need to add a new flag to null-co so it would respond with -ENOMEDIUM to > all requests or something)... The only issue I had is how that would > work together with the GRAPH_MOD op blocker. In order to answer this question, I'd first have to understand what GRAPH_MOD is even supposed to mean and which operations it needs to protect. There aren't currently any users of GRAPH_MOD. Kevin --dc+cDN39EJAMEtIO Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJaKpjrAAoJEH8JsnLIjy/WjBcQAIp04GUUFmFZcn4/to187o7s wEA1UEjRwCnm4uuCKmZvyboF+yj+ZGQFFtMr0BUPjpa/VAOk1GVnRvjlbroWg5Mc 7k/F42JjauFgJfVJk4DEhNNUitsoLcedeqCb2H16F9ul2uZGIebCsIreiznVzefA JR1mqgscX2aef025o7RWcvrZhsyIEb/XZFXQwzEM2kyeMbt5r1vRLF5sLuAdz3Yf srD9kmDIDhMHDHop4ndSissEFLn/uoQcSNiwEvQHco9gH87TmJpIgMBSjw/6zUl5 4qKcXpW3L3yh/TMbItnXU4nksCGzd6uoHjlfbOK8cnrigzn12uLcewQkbkawwWuD VO5Ai1ylIBGekkKj0DX80ZGkl6CSmfWTg16B+t0HP4DcItmiQHHadsXqx6o42FSY wYVgNY/OGUzq0VE9pexNUs4i9Un8vb8/jBnRh2XqukpSAxlHC3QrpxY4DUstsoKq cN9AaNGH6AeRqKg/gSmtcRr8Y5pJj2QRNH8vP1a66pmwfU15hxYAoRHxUrkse//u PJ6DZYz+prArLneM1K0XAhhnl/7Y7OzNPduJsDZjhLoP4vJ8sz24jVL8f+nAKj9i IX6UQAkgKKhrJftqn9DuJyl0TbEs9iEo2LbClQl4EeS4Rwqdw3q5gPfIrD/Jo0/6 e9GSHuTc6iNDbgThU8Al =ZN8c -----END PGP SIGNATURE----- --dc+cDN39EJAMEtIO--