From patchwork Tue Nov 21 15:10:16 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kevin Wolf X-Patchwork-Id: 840081 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yh8FD71RWz9s71 for ; Wed, 22 Nov 2017 02:11:44 +1100 (AEDT) Received: from localhost ([::1]:34999 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eHAD8-0003So-VW for incoming@patchwork.ozlabs.org; Tue, 21 Nov 2017 10:11:43 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37084) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eHAC9-0003C3-0i for qemu-devel@nongnu.org; Tue, 21 Nov 2017 10:10:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eHAC7-0005He-MT for qemu-devel@nongnu.org; Tue, 21 Nov 2017 10:10:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47193) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eHAC3-0005E3-Qn; Tue, 21 Nov 2017 10:10:36 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 153124DB12; Tue, 21 Nov 2017 15:10:35 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-117-148.ams2.redhat.com [10.36.117.148]) by smtp.corp.redhat.com (Postfix) with ESMTP id 232BB7FAA1; Tue, 21 Nov 2017 15:10:32 +0000 (UTC) From: Kevin Wolf To: qemu-block@nongnu.org Date: Tue, 21 Nov 2017 16:10:16 +0100 Message-Id: <20171121151017.28158-7-kwolf@redhat.com> In-Reply-To: <20171121151017.28158-1-kwolf@redhat.com> References: <20171121151017.28158-1-kwolf@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Tue, 21 Nov 2017 15:10:35 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 6/7] block: Close a BlockDriverState completely even when bs->drv is NULL X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, peter.maydell@linaro.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Alberto Garcia bdrv_close() skips much of its logic when bs->drv is NULL. This is fine when we're closing a BlockDriverState that has just been created (because e.g the initialization process failed), but it's not enough in other cases. For example, when a valid qcow2 image is found to be corrupted then QEMU marks it as such in the file header and then sets bs->drv to NULL in order to make the BlockDriverState unusable. When that BDS is later closed then many of its data structures are not freed (leaking their memory) and none of its children are detached. This results in bdrv_close_all() failing to close all BDSs and making this assertion fail when QEMU is being shut down: bdrv_close_all: Assertion `QTAILQ_EMPTY(&all_bdrv_states)' failed. This patch makes bdrv_close() do the full uninitialization process in all cases. This fixes the problem with corrupted images and still works fine with freshly created BDSs. Signed-off-by: Alberto Garcia Message-id: 20171106145345.12038-1-berto@igalia.com Reviewed-by: Eric Blake Signed-off-by: Max Reitz --- block.c | 57 +++++++++++++++++++++++----------------------- tests/qemu-iotests/060 | 13 +++++++++++ tests/qemu-iotests/060.out | 12 ++++++++++ 3 files changed, 53 insertions(+), 29 deletions(-) diff --git a/block.c b/block.c index 68b724206d..9a1a0d1e73 100644 --- a/block.c +++ b/block.c @@ -3198,6 +3198,7 @@ void bdrv_reopen_abort(BDRVReopenState *reopen_state) static void bdrv_close(BlockDriverState *bs) { BdrvAioNotifier *ban, *ban_next; + BdrvChild *child, *next; assert(!bs->job); assert(!bs->refcnt); @@ -3207,43 +3208,41 @@ static void bdrv_close(BlockDriverState *bs) bdrv_drain(bs); /* in case flush left pending I/O */ if (bs->drv) { - BdrvChild *child, *next; - bs->drv->bdrv_close(bs); bs->drv = NULL; + } - bdrv_set_backing_hd(bs, NULL, &error_abort); + bdrv_set_backing_hd(bs, NULL, &error_abort); - if (bs->file != NULL) { - bdrv_unref_child(bs, bs->file); - bs->file = NULL; - } + if (bs->file != NULL) { + bdrv_unref_child(bs, bs->file); + bs->file = NULL; + } - QLIST_FOREACH_SAFE(child, &bs->children, next, next) { - /* TODO Remove bdrv_unref() from drivers' close function and use - * bdrv_unref_child() here */ - if (child->bs->inherits_from == bs) { - child->bs->inherits_from = NULL; - } - bdrv_detach_child(child); + QLIST_FOREACH_SAFE(child, &bs->children, next, next) { + /* TODO Remove bdrv_unref() from drivers' close function and use + * bdrv_unref_child() here */ + if (child->bs->inherits_from == bs) { + child->bs->inherits_from = NULL; } - - g_free(bs->opaque); - bs->opaque = NULL; - atomic_set(&bs->copy_on_read, 0); - bs->backing_file[0] = '\0'; - bs->backing_format[0] = '\0'; - bs->total_sectors = 0; - bs->encrypted = false; - bs->sg = false; - QDECREF(bs->options); - QDECREF(bs->explicit_options); - bs->options = NULL; - bs->explicit_options = NULL; - QDECREF(bs->full_open_options); - bs->full_open_options = NULL; + bdrv_detach_child(child); } + g_free(bs->opaque); + bs->opaque = NULL; + atomic_set(&bs->copy_on_read, 0); + bs->backing_file[0] = '\0'; + bs->backing_format[0] = '\0'; + bs->total_sectors = 0; + bs->encrypted = false; + bs->sg = false; + QDECREF(bs->options); + QDECREF(bs->explicit_options); + bs->options = NULL; + bs->explicit_options = NULL; + QDECREF(bs->full_open_options); + bs->full_open_options = NULL; + bdrv_release_named_dirty_bitmaps(bs); assert(QLIST_EMPTY(&bs->dirty_bitmaps)); diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index 1eca09417b..14797dd3b0 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -426,6 +426,19 @@ echo '--- Repairing ---' _check_test_img -q -r all _check_test_img -r all +echo +echo "=== Testing the QEMU shutdown with a corrupted image ===" +echo +_make_test_img 64M +poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00" +echo "{'execute': 'qmp_capabilities'} + {'execute': 'human-monitor-command', + 'arguments': {'command-line': 'qemu-io drive \"write 0 512\"'}} + {'execute': 'quit'}" \ + | $QEMU -qmp stdio -nographic -nodefaults \ + -drive if=none,node-name=drive,file="$TEST_IMG",driver=qcow2 \ + | _filter_qmp | _filter_qemu_io + # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out index 56f5eb15d8..c4cb7c665e 100644 --- a/tests/qemu-iotests/060.out +++ b/tests/qemu-iotests/060.out @@ -399,4 +399,16 @@ The following inconsistencies were found and repaired: Double checking the fixed image now... No errors were found on the image. + +=== Testing the QEMU shutdown with a corrupted image === + +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 +qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with refcount table); further corruption events will be suppressed +QMP_VERSION +{"return": {}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event": "BLOCK_IMAGE_CORRUPTED", "data": {"device": "none0", "msg": "Preventing invalid write on metadata (overlaps with refcount table)", "offset": 65536, "node-name": "drive", "fatal": true, "size": 65536}} +write failed: Input/output error +{"return": ""} +{"return": {}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}} *** done