Il 08/04/2013 17:53, Stefan Hajnoczi ha scritto:
> On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
>> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
>> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
>> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
>> command has no IOCB.
>>
>> The callpath is:
>> scsi_dma_complete
>> dma_complete
>> dma_bdrv_cb
>> dma_bdrv_io
>> dma_bdrv_read
>> scsi_do_read
>> bdrv_co_em_bh
>> aio_bh_poll
>> aio_poll.
>>
>> At the assertion, we have a zero-element iovector and the request has
>> a status of -1.
>
> CCing Paolo Bonzini and Asias He. See the ./MAINTAINERS file to find
> people that can help with specific QEMU subsystems.
>
> It would be nice to include a full gdb backtrace when possible since
> that may include extra information like that value of arguments in the
> call stack.
The bug should actually be quite trivial, but I will only test the
attached patch tomorrow.
Thanks,
Paolo
>From 38d68bdee0d4cc75527da963e3b66a67aa0aadcc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonz...@redhat.com>
Date: Mon, 8 Apr 2013 18:50:15 +0200
Subject: [PATCH] scsi: avoid assertion failure on VERIFY command
A verify command is not an actual read (we do not implement
compare mode) and thus does not have an AIOCB attached. Do
not crash in scsi_dma_complete.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
---
hw/scsi-disk.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index c5c7bf3..068d9bb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -244,14 +244,15 @@ done:
}
}
-static void scsi_dma_complete(void *opaque, int ret)
+static void scsi_dma_complete_noio(void *opaque, int ret)
{
SCSIDiskReq *r = (SCSIDiskReq *)opaque;
SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- assert(r->req.aiocb != NULL);
- r->req.aiocb = NULL;
- bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+ if (r->req.aiocb != NULL) {
+ r->req.aiocb = NULL;
+ bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+ }
if (r->req.io_canceled) {
goto done;
}
@@ -277,6 +278,14 @@ done:
}
}
+static void scsi_dma_complete(void *opaque, int ret)
+{
+ SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+
+ assert(r->req.aiocb != NULL);
+ scsi_dma_complete_noio(opaque, ret);
+}
+
static void scsi_read_complete(void * opaque, int ret)
{
SCSIDiskReq *r = (SCSIDiskReq *)opaque;
@@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req)
if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
r->req.cmd.buf[0] == VERIFY_16) {
if (r->req.sg) {
- scsi_dma_complete(r, 0);
+ scsi_dma_complete_noio(r, 0);
} else {
scsi_write_complete(r, 0);
}
--
1.8.2
