[PATCH 0/2] block: do not try to list nearly-dropped filters

[PATCH 0/2] block: do not try to list nearly-dropped filters

[Andrey Zhadchenko via]

QEMU crashes on QMP command 'query-named-block-nodes' if we have
finalized but not dismissed block job with filter, for example
block-stream.
This happens because the filter no longer has references from which
QEMU can query block info. Skip such filters while listing block nodes.

This patchset also adds simple test for this case.

Andrey Zhadchenko (2):
  block: do not try to list nearly-dropped filters
  iotests: add new test case for image streaming

 block.c                    |  7 +++++--
 block/qapi.c               |  5 +++++
 tests/qemu-iotests/030     | 17 +++++++++++++++++
 tests/qemu-iotests/030.out |  4 ++--
 4 files changed, 29 insertions(+), 4 deletions(-)

-- 
2.40.1

[PATCH 1/2] block: do not try to list nearly-dropped filters

[Andrey Zhadchenko via]

When the block job ends, it removes filter from the tree. However the
last reference to filter bds is dropped when the job is destroyed.
So when we have finalized but not dismissed job, if we try to
'query-named-block-nodes', QEMU will stumble upon a half-dead filter
and crash, since the filter now has no childs, no bd->file, etc.

Example of crash:

Thread 1 "qemu-storage-da" received signal SIGSEGV, Segmentation fault.
0x000000000048795e in bdrv_refresh_filename (bs=0x7a5280) at ../block.c:7860
7860	        assert(QLIST_NEXT(child, next) == NULL);
(gdb) bt
0  0x000000000048795e in bdrv_refresh_filename (bs=0x7a5280) at ../block.c:7860
1  0x00000000004e2804 in bdrv_block_device_info (blk=0x0, bs=0x7a5280, flat=false, errp=0x7fffffffdaa0) at ../block/qapi.c:58
2  0x000000000049634e in bdrv_named_nodes_list (flat=false, errp=0x7fffffffdaa0) at ../block.c:6098
3  0x000000000047fe1b in qmp_query_named_block_nodes (has_flat=false, flat=false, errp=0x7fffffffdaa0) at ../blockdev.c:3097
4  0x00000000005a381d in qmp_marshal_query_named_block_nodes (args=0x7fffe80075d0, ret=0x7ffff6c38e38, errp=0x7ffff6c38e40)
    at qapi/qapi-commands-block-core.c:554
5  0x00000000005de657 in do_qmp_dispatch_bh (opaque=0x7ffff6c38e08) at ../qapi/qmp-dispatch.c:128
6  0x0000000000603f42 in aio_bh_call (bh=0x773c00) at ../util/async.c:142
7  0x000000000060407d in aio_bh_poll (ctx=0x75de00) at ../util/async.c:170
8  0x00000000005eb809 in aio_dispatch (ctx=0x75de00) at ../util/aio-posix.c:421
9  0x0000000000604eea in aio_ctx_dispatch (source=0x75de00, callback=0x0, user_data=0x0) at ../util/async.c:312
10 0x00007ffff7c93d6f in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
11 0x0000000000617508 in glib_pollfds_poll () at ../util/main-loop.c:297
12 0x0000000000617360 in os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:320
13 0x0000000000617263 in main_loop_wait (nonblocking=0) at ../util/main-loop.c:596
14 0x000000000046bbd6 in main (argc=13, argv=0x7fffffffde28) at ../storage-daemon/qemu-storage-daemon.c:409

Allow bdrv_block_device_info() to return NULL for filters in a such
state. Modify bdrv_named_nodes_list() to skip bds for which it cannot
get an info.

Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko@virtuozzo.com>
---
 block.c      | 7 +++++--
 block/qapi.c | 5 +++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index a307c151a8..e559b0aafa 100644
--- a/block.c
+++ b/block.c
@@ -6145,16 +6145,19 @@ BlockDeviceInfoList *bdrv_named_nodes_list(bool flat,
     BlockDeviceInfoList *list;
     BlockDriverState *bs;
 
+    ERRP_GUARD();
     GLOBAL_STATE_CODE();
 
     list = NULL;
     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
         BlockDeviceInfo *info = bdrv_block_device_info(NULL, bs, flat, errp);
-        if (!info) {
+        if (*errp) {
             qapi_free_BlockDeviceInfoList(list);
             return NULL;
         }
-        QAPI_LIST_PREPEND(list, info);
+        if (info) {
+            QAPI_LIST_PREPEND(list, info);
+        }
     }
 
     return list;
diff --git a/block/qapi.c b/block/qapi.c
index f34f95e0ef..b7b48f7540 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -57,6 +57,11 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
         return NULL;
     }
 
+    /* Do not try to get info from empty filters */
+    if (bs->drv->is_filter && !QLIST_FIRST(&bs->children)) {
+        return NULL;
+    }
+
     bdrv_refresh_filename(bs);
 
     info = g_malloc0(sizeof(*info));
-- 
2.40.1

[PATCH 2/2] iotests: add new test case for image streaming

[Andrey Zhadchenko via]

Check if we can list named block nodes when the block-stream is
finalized but not yet dismissed
This previously led to a crash

Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko@virtuozzo.com>
---
 tests/qemu-iotests/030     | 17 +++++++++++++++++
 tests/qemu-iotests/030.out |  4 ++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030
index 98595d47fe..2be407a8da 100755
--- a/tests/qemu-iotests/030
+++ b/tests/qemu-iotests/030
@@ -192,6 +192,23 @@ test_img = os.path.join(iotests.test_dir, 'test.img')
             self.assert_qmp(result, 'return', {})
 
 
+    def test_auto_dismiss(self):
+        result = self.vm.qmp('block-stream', device='drive0', auto_dismiss=False)
+        completed = False
+        while not completed:
+            for event in self.vm.get_qmp_events(wait=True):
+                self.assertNotEqual(event['event'], 'BLOCK_JOB_ERROR')
+                if event['event'] == 'BLOCK_JOB_COMPLETED':
+                    self.assert_qmp(event, 'data/device', 'drive0')
+                    completed = True
+                elif event['event'] == 'JOB_STATUS_CHANGE':
+                    self.assert_qmp(event, 'data/id', 'drive0')
+
+        result = self.vm.qmp('query-named-block-nodes')
+        result = self.vm.qmp('job-dismiss', id='drive0')
+        self.assert_qmp(result, 'return', {})
+
+
 class TestParallelOps(iotests.QMPTestCase):
     num_ops = 4 # Number of parallel block-stream operations
     num_imgs = num_ops * 2 + 1
diff --git a/tests/qemu-iotests/030.out b/tests/qemu-iotests/030.out
index 6d9bee1a4b..af8dac10f9 100644
--- a/tests/qemu-iotests/030.out
+++ b/tests/qemu-iotests/030.out
@@ -1,5 +1,5 @@
-...........................
+............................
 ----------------------------------------------------------------------
-Ran 27 tests
+Ran 28 tests
 
 OK
-- 
2.40.1