From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:40406) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RDdB5-0008UU-IV for qemu-devel@nongnu.org; Tue, 11 Oct 2011 10:19:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RDdAz-00042u-Du for qemu-devel@nongnu.org; Tue, 11 Oct 2011 10:19:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:19879) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RDdAz-00042l-2H for qemu-devel@nongnu.org; Tue, 11 Oct 2011 10:19:25 -0400 Message-ID: <4E945113.1080007@redhat.com> Date: Tue, 11 Oct 2011 16:22:11 +0200 From: Kevin Wolf MIME-Version: 1.0 References: <1317379151-11557-1-git-send-email-stefanha@linux.vnet.ibm.com> <20110930112759.GI21901@amit-x200.redhat.com> <20110930154930.GJ21901@amit-x200.redhat.com> In-Reply-To: <20110930154930.GJ21901@amit-x200.redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Amit Shah Cc: Stefan Hajnoczi , Anthony Liguori , Stefan Hajnoczi , qemu-devel@nongnu.org Am 30.09.2011 17:49, schrieb Amit Shah: > On (Fri) 30 Sep 2011 [16:23:30], Stefan Hajnoczi wrote: >> On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah wrote: >>> On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote: >>>> QED's metadata caching strategy allows two parallel requests to race for >>>> metadata lookup. The first one to complete will populate the metadata >>>> cache and the second one will drop the data it just read in favor of the >>>> cached data. >>>> >>>> There is a use-after-free in qed_read_l2_table_cb() and >>>> qed_commit_l2_update() where l2_table->offset was used after the >>>> l2_table may have been freed due to a metadata lookup race. Fix this by >>>> keeping the l2_offset in a local variable and not reaching into the >>>> possibly freed l2_table. >>>> >>>> Reported-by: Amit Shah >>>> Signed-off-by: Stefan Hajnoczi >>>> --- >>>> Hi Amit, >>>> Thanks for reporting the assertion failure you saw at http://fpaste.org/CDuv/. >>>> Does this patch fix the problem? >>> >>> Yes, this fixes it. >> >> Were you able to reliably reproduce the assertion failure before? > > Absolutely. > > I even reverted the patch and tried the same image; same segfault > again. > >> I wonder because this only happens when two metadata lookups race >> (which is rare enough on my setup that I've never seen this failure). >> It might be worth trying a few times. > > Get the F16 beta-rc LXE live iso, install guest. It doesn't cleanly > reboot, you have to kill the VM. Next start of the VM produces this > segfault. > > https://alt.fedoraproject.org/pub/alt/stage/16-Beta.RC2/Live/x86_64/Fedora-16-Beta-x86_64-Live-LXDE.iso Can we try to artificially produce it in a qemu-iotests case? Kevin