From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:54181) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UPFJ0-0007zY-Ua for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UPFIv-0004Xm-Hv for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:11740) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UPFIv-0004XA-8V for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:25 -0400 Message-ID: <5162F5C0.9080208@redhat.com> Date: Mon, 08 Apr 2013 18:52:16 +0200 From: Paolo Bonzini MIME-Version: 1.0 References: <20130408155327.GD22660@stefanha-thinkpad.redhat.com> In-Reply-To: <20130408155327.GD22660@stefanha-thinkpad.redhat.com> Content-Type: multipart/mixed; boundary="------------070405070003080404030409" Subject: Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Asias He , qemu-devel@nongnu.org, Venkatesh Srinivas This is a multi-part message in MIME format. --------------070405070003080404030409 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Il 08/04/2013 17:53, Stefan Hajnoczi ha scritto: > On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote: >> When a Linux guest does a simple 'sg_verify /dev/> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an >> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA >> command has no IOCB. >> >> The callpath is: >> scsi_dma_complete >> dma_complete >> dma_bdrv_cb >> dma_bdrv_io >> dma_bdrv_read >> scsi_do_read >> bdrv_co_em_bh >> aio_bh_poll >> aio_poll. >> >> At the assertion, we have a zero-element iovector and the request has >> a status of -1. > > CCing Paolo Bonzini and Asias He. See the ./MAINTAINERS file to find > people that can help with specific QEMU subsystems. > > It would be nice to include a full gdb backtrace when possible since > that may include extra information like that value of arguments in the > call stack. The bug should actually be quite trivial, but I will only test the attached patch tomorrow. Thanks, Paolo --------------070405070003080404030409 Content-Type: text/x-patch; name="0001-scsi-avoid-assertion-failure-on-VERIFY-command.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0001-scsi-avoid-assertion-failure-on-VERIFY-command.patch" >>From 38d68bdee0d4cc75527da963e3b66a67aa0aadcc Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Mon, 8 Apr 2013 18:50:15 +0200 Subject: [PATCH] scsi: avoid assertion failure on VERIFY command A verify command is not an actual read (we do not implement compare mode) and thus does not have an AIOCB attached. Do not crash in scsi_dma_complete. Signed-off-by: Paolo Bonzini --- hw/scsi-disk.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index c5c7bf3..068d9bb 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -244,14 +244,15 @@ done: } } -static void scsi_dma_complete(void *opaque, int ret) +static void scsi_dma_complete_noio(void *opaque, int ret) { SCSIDiskReq *r = (SCSIDiskReq *)opaque; SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev); - assert(r->req.aiocb != NULL); - r->req.aiocb = NULL; - bdrv_acct_done(s->qdev.conf.bs, &r->acct); + if (r->req.aiocb != NULL) { + r->req.aiocb = NULL; + bdrv_acct_done(s->qdev.conf.bs, &r->acct); + } if (r->req.io_canceled) { goto done; } @@ -277,6 +278,14 @@ done: } } +static void scsi_dma_complete(void *opaque, int ret) +{ + SCSIDiskReq *r = (SCSIDiskReq *)opaque; + + assert(r->req.aiocb != NULL); + scsi_dma_complete_noio(opaque, ret); +} + static void scsi_read_complete(void * opaque, int ret) { SCSIDiskReq *r = (SCSIDiskReq *)opaque; @@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req) if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 || r->req.cmd.buf[0] == VERIFY_16) { if (r->req.sg) { - scsi_dma_complete(r, 0); + scsi_dma_complete_noio(r, 0); } else { scsi_write_complete(r, 0); } -- 1.8.2 --------------070405070003080404030409--