From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:44186)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1SQCNh-0001yA-PY
	for qemu-devel@nongnu.org; Fri, 04 May 2012 02:52:47 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1SQCNe-0004Xw-N6
	for qemu-devel@nongnu.org; Fri, 04 May 2012 02:52:45 -0400
Received: from mx1.redhat.com ([209.132.183.28]:8066)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1SQCNe-0004X7-Ex
	for qemu-devel@nongnu.org; Fri, 04 May 2012 02:52:42 -0400
Message-ID: <4FA37CB4.6070407@redhat.com>
Date: Fri, 04 May 2012 08:52:36 +0200
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <1336066583-10503-1-git-send-email-sw@weilnetz.de>
	<4FA2F18E.4020001@weilnetz.de>
In-Reply-To: <4FA2F18E.4020001@weilnetz.de>
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 1.1] scsi: Add assertion for use-after-free
 errors
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Weil <sw@weilnetz.de>
Cc: Anthony Liguori <aliguori@us.ibm.com>, qemu-devel@nongnu.org

Il 03/05/2012 22:58, Stefan Weil ha scritto:
> Am 03.05.2012 19:36, schrieb Stefan Weil:
>> The QEMU emulation which is currently used with Raspberry PI images
>> (qemu-system-arm -M versatilepb ...) accesses memory which was freed.
>>
>> Valgrind output (extract):
>>
>> ==17857== Invalid write of size 4
>> ==17857== at 0x24EB06: scsi_req_unref (scsi-bus.c:1273)
>> ==17857== by 0x24FFAE: scsi_read_complete (scsi-disk.c:277)
>> ==17857== by 0x152ACC: bdrv_co_em_bh (block.c:3363)
>> ==17857== by 0x13D49C: qemu_bh_poll (async.c:71)
>> ==17857== by 0x211A8C: main_loop_wait (main-loop.c:503)
>> ==17857== by 0x207954: main_loop (vl.c:1555)
>> ==17857== by 0x20E9C9: main (vl.c:3653)
>> ==17857== Address 0x1c54383c is 12 bytes inside a block of size 260
>> free'd
>> ==17857== at 0x4824B3A: free (vg_replace_malloc.c:366)
>> ==17857== by 0x20ADFA: free_and_trace (vl.c:2250)
>> ==17857== by 0x4899FC5: g_free (in /lib/libglib-2.0.so.0.2400.1)
>> ==17857== by 0x24EB3B: scsi_req_unref (scsi-bus.c:1277)
>> ==17857== by 0x24F003: scsi_req_complete (scsi-bus.c:1383)
>> ==17857== by 0x25022A: scsi_read_data (scsi-disk.c:334)
>> ==17857== by 0x24EB9F: scsi_req_continue (scsi-bus.c:1289)
>> ==17857== by 0x1C7787: lsi_do_dma (lsi53c895a.c:575)
>> ==17857== by 0x1C8CDA: lsi_execute_script (lsi53c895a.c:1147)
>> ==17857== by 0x1C74EA: lsi_resume_script (lsi53c895a.c:510)
>> ==17857== by 0x1C7ECD: lsi_transfer_data (lsi53c895a.c:746)
>> ==17857== by 0x24EC90: scsi_req_data (scsi-bus.c:1307)

Yes, this was reported by David Gibson too.  Interesting that
virtio-scsi doesn't show it, probably it's the sglist support that hides
it.  I queued the fix and I'm sending the pull request in a matter of
minutes.  The patch is a good addition so I queued it too, thanks.

Paolo