Re: [Qemu-devel] [PULL 1/2] virtio-scsi: fixed virtio_scsi_ctx_check failed when detaching scsi disk

[Peter Maydell <peter.maydell@linaro.org>]

On Mon, 22 Jul 2019 at 17:17, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> From: Zhengui li <lizhengui@huawei.com>
>
> commit a6f230c move blockbackend back to main AioContext on unplug. It set the AioContext of
> SCSIDevice to the main AioContex, but s->ctx is still the iothread AioContex（if the scsi controller
> is configure with iothread）. So if there are having in-flight requests during unplug, a failing assertion
> happend. The bt is below:
> (gdb) bt
> #0  0x0000ffff86aacbd0 in raise () from /lib64/libc.so.6
> #1  0x0000ffff86aadf7c in abort () from /lib64/libc.so.6
> #2  0x0000ffff86aa6124 in __assert_fail_base () from /lib64/libc.so.6
> #3  0x0000ffff86aa61a4 in __assert_fail () from /lib64/libc.so.6
> #4  0x0000000000529118 in virtio_scsi_ctx_check (d=<optimized out>, s=<optimized out>, s=<optimized out>) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:246
> #5  0x0000000000529ec4 in virtio_scsi_handle_cmd_req_prepare (s=0x2779ec00, req=0xffff740397d0) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:559
> #6  0x000000000052a228 in virtio_scsi_handle_cmd_vq (s=0x2779ec00, vq=0xffff7c6d7110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:603
> #7  0x000000000052afa8 in virtio_scsi_data_plane_handle_cmd (vdev=<optimized out>, vq=0xffff7c6d7110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi-dataplane.c:59
> #8  0x000000000054d94c in virtio_queue_host_notifier_aio_poll (opaque=<optimized out>) at /home/qemu-4.0.0/hw/virtio/virtio.c:2452
>
> assert(blk_get_aio_context(d->conf.blk) == s->ctx) failed.
>
> To avoid assertion failed,  moving the "if" after qdev_simple_device_unplug_cb.
>
> In addition, to avoid another qemu crash below, add aio_disable_external before
> qdev_simple_device_unplug_cb, which disable the further processing of external clients
> when doing qdev_simple_device_unplug_cb.
> (gdb) bt
> #0  scsi_req_unref (req=0xffff6802c6f0) at hw/scsi/scsi-bus.c:1283
> #1  0x00000000005294a4 in virtio_scsi_handle_cmd_req_submit (req=<optimized out>,
>     s=<optimized out>) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:589
> #2  0x000000000052a2a8 in virtio_scsi_handle_cmd_vq (s=s@entry=0x9c90e90,
>     vq=vq@entry=0xffff7c05f110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:625
> #3  0x000000000052afd8 in virtio_scsi_data_plane_handle_cmd (vdev=<optimized out>,
>     vq=0xffff7c05f110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi-dataplane.c:60
> #4  0x000000000054d97c in virtio_queue_host_notifier_aio_poll (opaque=<optimized out>)
>     at /home/qemu-4.0.0/hw/virtio/virtio.c:2447
> #5  0x00000000009b204c in run_poll_handlers_once (ctx=ctx@entry=0x6efea40,
>     timeout=timeout@entry=0xffff7d7f7308) at util/aio-posix.c:521
> #6  0x00000000009b2b64 in run_poll_handlers (ctx=ctx@entry=0x6efea40,
>     max_ns=max_ns@entry=4000, timeout=timeout@entry=0xffff7d7f7308) at util/aio-posix.c:559
> #7  0x00000000009b2ca0 in try_poll_mode (ctx=ctx@entry=0x6efea40, timeout=0xffff7d7f7308,
>     timeout@entry=0xffff7d7f7348) at util/aio-posix.c:594
> #8  0x00000000009b31b8 in aio_poll (ctx=0x6efea40, blocking=blocking@entry=true)
>     at util/aio-posix.c:636
> #9  0x00000000006973cc in iothread_run (opaque=0x6ebd800) at iothread.c:75
> #10 0x00000000009b592c in qemu_thread_start (args=0x6efef60) at util/qemu-thread-posix.c:502
> #11 0x0000ffff8057f8bc in start_thread () from /lib64/libpthread.so.0
> #12 0x0000ffff804e5f8c in thread_start () from /lib64/libc.so.6
> (gdb) p bus
> $1 = (SCSIBus *) 0x0
>
> Signed-off-by: Zhengui li <lizhengui@huawei.com>
> Message-Id: <1563696502-7972-1-git-send-email-lizhengui@huawei.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/scsi/virtio-scsi.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index d0bdbff090..aa33819d59 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -841,14 +841,16 @@ static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
>          virtio_scsi_release(s);
>      }
>
> +    aio_disable_external(s->ctx);
> +    qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
> +    aio_enable_external(s->ctx);

These new calls assume s->ctx is non-NULL...

> +
>      if (s->ctx) {

...but the existing code believes it might be NULL.
Coverity would have complained about this even if 'make check'
didn't catch the bug.

>          virtio_scsi_acquire(s);
>          /* If other users keep the BlockBackend in the iothread, that's ok */
>          blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
>          virtio_scsi_release(s);
>      }
> -
> -    qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
>  }

thanks
-- PMM