From patchwork Mon Apr 8 16:52:16 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 234844 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 59BBB2C00A2 for ; Tue, 9 Apr 2013 02:52:53 +1000 (EST) Received: from localhost ([::1]:39568 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UPFJL-0007zo-HN for incoming@patchwork.ozlabs.org; Mon, 08 Apr 2013 12:52:51 -0400 Received: from eggs.gnu.org ([208.118.235.92]:54181) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UPFJ0-0007zY-Ua for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UPFIv-0004Xm-Hv for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:11740) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UPFIv-0004XA-8V for qemu-devel@nongnu.org; Mon, 08 Apr 2013 12:52:25 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r38GqMRP024813 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 8 Apr 2013 12:52:22 -0400 Received: from yakj.usersys.redhat.com (ovpn-112-50.ams2.redhat.com [10.36.112.50]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r38GqK7b008990; Mon, 8 Apr 2013 12:52:21 -0400 Message-ID: <5162F5C0.9080208@redhat.com> Date: Mon, 08 Apr 2013 18:52:16 +0200 From: Paolo Bonzini User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130311 Thunderbird/17.0.4 MIME-Version: 1.0 To: Stefan Hajnoczi References: <20130408155327.GD22660@stefanha-thinkpad.redhat.com> In-Reply-To: <20130408155327.GD22660@stefanha-thinkpad.redhat.com> X-Enigmail-Version: 1.5.1 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Asias He , qemu-devel@nongnu.org, Venkatesh Srinivas Subject: Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Il 08/04/2013 17:53, Stefan Hajnoczi ha scritto: > On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote: >> When a Linux guest does a simple 'sg_verify /dev/> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an >> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA >> command has no IOCB. >> >> The callpath is: >> scsi_dma_complete >> dma_complete >> dma_bdrv_cb >> dma_bdrv_io >> dma_bdrv_read >> scsi_do_read >> bdrv_co_em_bh >> aio_bh_poll >> aio_poll. >> >> At the assertion, we have a zero-element iovector and the request has >> a status of -1. > > CCing Paolo Bonzini and Asias He. See the ./MAINTAINERS file to find > people that can help with specific QEMU subsystems. > > It would be nice to include a full gdb backtrace when possible since > that may include extra information like that value of arguments in the > call stack. The bug should actually be quite trivial, but I will only test the attached patch tomorrow. Thanks, Paolo From 38d68bdee0d4cc75527da963e3b66a67aa0aadcc Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Mon, 8 Apr 2013 18:50:15 +0200 Subject: [PATCH] scsi: avoid assertion failure on VERIFY command A verify command is not an actual read (we do not implement compare mode) and thus does not have an AIOCB attached. Do not crash in scsi_dma_complete. Signed-off-by: Paolo Bonzini --- hw/scsi-disk.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index c5c7bf3..068d9bb 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -244,14 +244,15 @@ done: } } -static void scsi_dma_complete(void *opaque, int ret) +static void scsi_dma_complete_noio(void *opaque, int ret) { SCSIDiskReq *r = (SCSIDiskReq *)opaque; SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev); - assert(r->req.aiocb != NULL); - r->req.aiocb = NULL; - bdrv_acct_done(s->qdev.conf.bs, &r->acct); + if (r->req.aiocb != NULL) { + r->req.aiocb = NULL; + bdrv_acct_done(s->qdev.conf.bs, &r->acct); + } if (r->req.io_canceled) { goto done; } @@ -277,6 +278,14 @@ done: } } +static void scsi_dma_complete(void *opaque, int ret) +{ + SCSIDiskReq *r = (SCSIDiskReq *)opaque; + + assert(r->req.aiocb != NULL); + scsi_dma_complete_noio(opaque, ret); +} + static void scsi_read_complete(void * opaque, int ret) { SCSIDiskReq *r = (SCSIDiskReq *)opaque; @@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req) if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 || r->req.cmd.buf[0] == VERIFY_16) { if (r->req.sg) { - scsi_dma_complete(r, 0); + scsi_dma_complete_noio(r, 0); } else { scsi_write_complete(r, 0); } -- 1.8.2