From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35384) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aeBuR-0004F9-Nl for qemu-devel@nongnu.org; Thu, 10 Mar 2016 20:30:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aeBuO-0001Mh-Hg for qemu-devel@nongnu.org; Thu, 10 Mar 2016 20:30:31 -0500 References: <1457612036-8953-1-git-send-email-berto@igalia.com> From: Wen Congyang Message-ID: <56E21FF3.9000603@cn.fujitsu.com> Date: Fri, 11 Mar 2016 09:31:31 +0800 MIME-Version: 1.0 In-Reply-To: <1457612036-8953-1-git-send-email-berto@igalia.com> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] quorum: Fix crash in quorum_aio_cb() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alberto Garcia , qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Max Reitz On 03/10/2016 08:13 PM, Alberto Garcia wrote: > quorum_aio_cb() emits the QUORUM_REPORT_BAD event if there's > an I/O error in a Quorum child. However sacb->aiocb must be > correctly initialized for this to happen. read_quorum_children() and > read_fifo_child() are not doing this, which results in a QEMU crash. If we use FIFO mode, we don't call quorum_report_bad() in quorum_aio_cb(). But it is OK to iniialize sacb->aiocb for it. > > Signed-off-by: Alberto Garcia > Reviewed-by: Max Reitz Reviewed-by: Wen Congyang > --- > block/quorum.c | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > > diff --git a/block/quorum.c b/block/quorum.c > index b9ba028..e640688 100644 > --- a/block/quorum.c > +++ b/block/quorum.c > @@ -646,8 +646,9 @@ static BlockAIOCB *read_quorum_children(QuorumAIOCB *acb) > } > > for (i = 0; i < s->num_children; i++) { > - bdrv_aio_readv(s->children[i]->bs, acb->sector_num, &acb->qcrs[i].qiov, > - acb->nb_sectors, quorum_aio_cb, &acb->qcrs[i]); > + acb->qcrs[i].aiocb = bdrv_aio_readv(s->children[i]->bs, acb->sector_num, > + &acb->qcrs[i].qiov, acb->nb_sectors, > + quorum_aio_cb, &acb->qcrs[i]); > } > > return &acb->common; > @@ -662,9 +663,10 @@ static BlockAIOCB *read_fifo_child(QuorumAIOCB *acb) > qemu_iovec_init(&acb->qcrs[acb->child_iter].qiov, acb->qiov->niov); > qemu_iovec_clone(&acb->qcrs[acb->child_iter].qiov, acb->qiov, > acb->qcrs[acb->child_iter].buf); > - bdrv_aio_readv(s->children[acb->child_iter]->bs, acb->sector_num, > - &acb->qcrs[acb->child_iter].qiov, acb->nb_sectors, > - quorum_aio_cb, &acb->qcrs[acb->child_iter]); > + acb->qcrs[acb->child_iter].aiocb = > + bdrv_aio_readv(s->children[acb->child_iter]->bs, acb->sector_num, > + &acb->qcrs[acb->child_iter].qiov, acb->nb_sectors, > + quorum_aio_cb, &acb->qcrs[acb->child_iter]); > > return &acb->common; > } >