From patchwork Mon Jan 25 01:20:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wen Congyang X-Patchwork-Id: 8103141 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id C33AA9F6DA for ; Mon, 25 Jan 2016 01:27:00 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D803C203A0 for ; Mon, 25 Jan 2016 01:26:59 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C3AFC2038D for ; Mon, 25 Jan 2016 01:26:58 +0000 (UTC) Received: from localhost ([::1]:34116 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aNVvm-0001fn-3O for patchwork-qemu-devel@patchwork.kernel.org; Sun, 24 Jan 2016 20:26:58 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49008) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aNVpV-0006IM-Ku for qemu-devel@nongnu.org; Sun, 24 Jan 2016 20:20:30 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aNVpU-0001pu-Ah for qemu-devel@nongnu.org; Sun, 24 Jan 2016 20:20:29 -0500 Received: from [59.151.112.132] (port=40268 helo=heian.cn.fujitsu.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aNVpO-0001jd-Pf; Sun, 24 Jan 2016 20:20:23 -0500 X-IronPort-AV: E=Sophos;i="5.20,346,1444665600"; d="scan'208";a="2920636" Received: from unknown (HELO cn.fujitsu.com) ([10.167.33.5]) by heian.cn.fujitsu.com with ESMTP; 25 Jan 2016 09:20:21 +0800 Received: from G08CNEXCHPEKD01.g08.fujitsu.local (unknown [10.167.33.80]) by cn.fujitsu.com (Postfix) with ESMTP id 5DCAF41824F2; Mon, 25 Jan 2016 09:19:40 +0800 (CST) Received: from [10.167.226.52] (10.167.226.52) by G08CNEXCHPEKD01.g08.fujitsu.local (10.167.33.89) with Microsoft SMTP Server id 14.3.181.6; Mon, 25 Jan 2016 09:19:40 +0800 To: "Dr. David Alan Gilbert" , Changlong Xie , zhanghailiang References: <20160122151412.GD2482@work-vm> From: Wen Congyang Message-ID: <56A57867.8000204@cn.fujitsu.com> Date: Mon, 25 Jan 2016 09:20:39 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: <20160122151412.GD2482@work-vm> X-Originating-IP: [10.167.226.52] X-yoursite-MailScanner-ID: 5DCAF41824F2.A95EC X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: wency@cn.fujitsu.com X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 59.151.112.132 Cc: Kevin Wolf , Fam Zheng , qemu block , Jiang Yunhong , Dong Eddie , qemu devel , "Michael R. Hines" , Max Reitz , Stefan Hajnoczi , Paolo Bonzini Subject: Re: [Qemu-devel] [PATCH v13 00/10] Block replication for continuous checkpoints X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 01/22/2016 11:14 PM, Dr. David Alan Gilbert wrote: > Hi, > I can trigger a segfault if I wire in the block replication together with > a quorum instance; it only triggers with both of them present but, > it looks like the problem is a disagreement about the number of quorum > members; I'm triggering this on the 'colo-v2.4-periodic-mode' branch > that is posted in the colo-framework set that I think includes this set > (from https://github.com/coloft/qemu.git). > > To trigger: > ./git/colo/jan-16/try/x86_64-softmmu/qemu-system-x86_64 -nographic -S > > (qemu) drive_add 0 if=none,id=colo-disk0,file.filename=/home/localvms/bugzilla.raw,driver=raw,node-name=node0 > (qemu) drive_add 1 if=none,id=active-disk0,throttling.bps-total=70000000,driver=replication,mode=secondary,file.driver=qcow2,file.file.filename=/run/colo-active-disk.qcow2,file.backing.driver=qcow2,file.backing.file.filename=/run/colo-hidden-disk.qcow2,file.backing.backing=colo-disk0 > (qemu) drive_add 2 if=none,id=top-quorum,driver=quorum,read-pattern=fifo,vote-threshold=1,children.0=active-disk0 > (qemu) device_add virtio-blk-pci,drive=top-quorum,addr=9 > > *** Error in `/root/colo/jan-2016/./try/x86_64-softmmu/qemu-system-x86_64': free(): invalid pointer: 0x0000555555a8fdf0 *** > ======= Backtrace: ========= > /lib64/libc.so.6(+0x7cfe1)[0x7ffff110ffe1] > /lib64/libglib-2.0.so.0(g_free+0xf)[0x7ffff1ecc36f] > /root/colo/jan-2016/./try/x86_64-softmmu/qemu-system-x86_64 > Program received signal SIGABRT, Aborted. > 0x00007ffff10c85f7 in raise () from /lib64/libc.so.6 > (gdb) where > #0 0x00007ffff10c85f7 in raise () from /lib64/libc.so.6 > #1 0x00007ffff10c9ce8 in abort () from /lib64/libc.so.6 > #2 0x00007ffff1108317 in __libc_message () from /lib64/libc.so.6 > #3 0x00007ffff110ffe1 in _int_free () from /lib64/libc.so.6 > #4 0x00007ffff1ecc36f in g_free () from /lib64/libglib-2.0.so.0 > #5 0x00005555559dfdd7 in qemu_iovec_destroy (qiov=0x555557815410) at /root/colo/jan-2016/qemu/util/iov.c:378 > #6 0x0000555555989cce in quorum_aio_finalize (acb=0x555557815350) at /root/colo/jan-2016/qemu/block/quorum.c:171 > 171 qemu_iovec_destroy(&acb->qcrs[i].qiov); > (gdb) list > 166 > 167 if (acb->is_read) { > 168 /* on the quorum case acb->child_iter == s->num_children - 1 */ > 169 for (i = 0; i <= acb->child_iter; i++) { > 170 qemu_vfree(acb->qcrs[i].buf); > 171 qemu_iovec_destroy(&acb->qcrs[i].qiov); > 172 } > 173 } > 174 > 175 g_free(acb->qcrs); > (gdb) p acb->child_iter > $1 = 1 > (gdb) p i > $3 = 1 > > #7 0x000055555598afca in quorum_aio_cb (opaque=, ret=-5) > at /root/colo/jan-2016/qemu/block/quorum.c:302 > #8 0x00005555559990ee in bdrv_co_complete (acb=0x555557815410) at /root/colo/jan-2016/qemu/block/io.c:2122 > ..... > > So I guess acb->child_iter is wrong, since we only have one child on that quorum? > and we're trying to do a destroy on the second child. Can you try the following patch: From 3f2c5ec288cd9a36afb392b4bba24029f3e9345a Mon Sep 17 00:00:00 2001 From: Wen Congyang Date: Mon, 25 Jan 2016 09:18:09 +0800 Subject: [PATCH] quorum: fix segfault when read fails in fifo mode Signed-off-by: Wen Congyang --- block/quorum.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/quorum.c b/block/quorum.c index a5ae4b8..0965277 100644 --- a/block/quorum.c +++ b/block/quorum.c @@ -295,6 +295,9 @@ static void quorum_aio_cb(void *opaque, int ret) quorum_copy_qiov(acb->qiov, &acb->qcrs[acb->child_iter].qiov); } acb->vote_ret = ret; + if (ret < 0) { + acb->child_iter--; + } quorum_aio_finalize(acb); return; }