[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PULL 21/35] block: fix QEMU crash with scsi-hd and drive_d
From: |
Kevin Wolf |
Subject: |
[Qemu-block] [PULL 21/35] block: fix QEMU crash with scsi-hd and drive_del |
Date: |
Mon, 18 Jun 2018 18:44:50 +0200 |
From: Greg Kurz <address@hidden>
Removing a drive with drive_del while it is being used to run an I/O
intensive workload can cause QEMU to crash.
An AIO flush can yield at some point:
blk_aio_flush_entry()
blk_co_flush(blk)
bdrv_co_flush(blk->root->bs)
...
qemu_coroutine_yield()
and let the HMP command to run, free blk->root and give control
back to the AIO flush:
hmp_drive_del()
blk_remove_bs()
bdrv_root_unref_child(blk->root)
child_bs = blk->root->bs
bdrv_detach_child(blk->root)
bdrv_replace_child(blk->root, NULL)
blk->root->bs = NULL
g_free(blk->root) <============== blk->root becomes stale
bdrv_unref(child_bs)
bdrv_delete(child_bs)
bdrv_close()
bdrv_drained_begin()
bdrv_do_drained_begin()
bdrv_drain_recurse()
aio_poll()
...
qemu_coroutine_switch()
and the AIO flush completion ends up dereferencing blk->root:
blk_aio_complete()
scsi_aio_complete()
blk_get_aio_context(blk)
bs = blk_bs(blk)
ie, bs = blk->root ? blk->root->bs : NULL
^^^^^
stale
The problem is that we should avoid making block driver graph
changes while we have in-flight requests. Let's drain all I/O
for this BB before calling bdrv_root_unref_child().
Signed-off-by: Greg Kurz <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
block/block-backend.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/block/block-backend.c b/block/block-backend.c
index 2d1a3463e8..6b75bca317 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -767,6 +767,11 @@ void blk_remove_bs(BlockBackend *blk)
blk_update_root_state(blk);
+ /* bdrv_root_unref_child() will cause blk->root to become stale and may
+ * switch to a completion coroutine later on. Let's drain all I/O here
+ * to avoid that and a potential QEMU crash.
+ */
+ blk_drain(blk);
bdrv_root_unref_child(blk->root);
blk->root = NULL;
}
--
2.13.6
- [Qemu-block] [PULL 09/35] test-bdrv-drain: Add test for node deletion, (continued)
- [Qemu-block] [PULL 09/35] test-bdrv-drain: Add test for node deletion, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 12/35] block: Don't poll in parent drain callbacks, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 11/35] test-bdrv-drain: Test node deletion in subtree recursion, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 10/35] block: Drain recursively with a single BDRV_POLL_WHILE(), Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 13/35] test-bdrv-drain: Graph change through parent callback, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 14/35] block: Defer .bdrv_drain_begin callback to polling phase, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 16/35] block: Allow AIO_WAIT_WHILE with NULL ctx, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 15/35] test-bdrv-drain: Test that bdrv_drain_invoke() doesn't poll, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 17/35] block: Move bdrv_drain_all_begin() out of coroutine context, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 19/35] block: Allow graph changes in bdrv_drain_all_begin/end sections, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 21/35] block: fix QEMU crash with scsi-hd and drive_del,
Kevin Wolf <=
- [Qemu-block] [PULL 18/35] block: ignore_bds_parents parameter for drain functions, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 23/35] block/mirror: Convert to coroutines, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 24/35] block/mirror: Use CoQueue to wait on in-flight ops, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 25/35] block/mirror: Wait for in-flight op conflicts, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 20/35] test-bdrv-drain: Test graph changes in drain_all section, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 22/35] block/mirror: Pull out mirror_perform(), Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 27/35] block: Generalize should_update_child() rule, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 26/35] block/mirror: Use source as a BdrvChild, Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 28/35] hbitmap: Add @advance param to hbitmap_iter_next(), Kevin Wolf, 2018/06/18
- [Qemu-block] [PULL 32/35] job: Add job_progress_increase_remaining(), Kevin Wolf, 2018/06/18