[Qemu-devel] [PATCH 0/2] scsi-disk: fix bugs in rerror/werror

[Qemu-devel] [PATCH 0/2] scsi-disk: fix bugs in rerror/werror

[Paolo Bonzini]

The first was reported on the mailing list, the second was found by
inspection.

Paolo Bonzini (2):
  scsi-disk: fix double completion of failing passthrough requests
  scsi-disk: fix rerror/werror=ignore

 hw/scsi/scsi-disk.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

-- 
1.8.3.1

[Qemu-devel] [PATCH 1/2] scsi-disk: fix double completion of failing passthrough requests

[Paolo Bonzini]

If a command fails with a sense that scsi_sense_buf_to_errno converts to
ECANCELED/EAGAIN/ENOTCONN or with a unit attention, scsi_req_complete is
called twice.  This caused a crash.

Reported-by: Wangguang <wang.guangA@h3c.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-disk.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index c43163c..4074d7c 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -441,9 +441,18 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
         }
         switch (error) {
         case 0:
-            /* The command has run, no need to fake sense.  */
+            /* A passthrough command has run and has produced sense data; check
+             * whether the error has to be handled by the guest or should rather
+             * pause the host.
+             */
             assert(r->status && *r->status);
-            scsi_req_complete(&r->req, *r->status);
+            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+            if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||
+                error == 0)  {
+                /* These errors are handled by guest. */
+                scsi_req_complete(&r->req, *r->status);
+                return true;
+            }
             break;
         case ENOMEDIUM:
             scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
@@ -462,17 +471,6 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
             break;
         }
     }
-    if (!error) {
-        assert(r->status && *r->status);
-        error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
-
-        if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||
-            error == 0)  {
-            /* These errors are handled by guest. */
-            scsi_req_complete(&r->req, *r->status);
-            return true;
-        }
-    }
 
     blk_error_action(s->qdev.conf.blk, action, is_read, error);
     if (action == BLOCK_ERROR_ACTION_STOP) {
-- 
1.8.3.1

[Qemu-devel] [PATCH 2/2] scsi-disk: fix rerror/werror=ignore

[Paolo Bonzini]

rerror=ignore was returning true from scsi_handle_rw_error but the callers were not
calling scsi_req_complete when rerror=ignore returns true (this is the correct thing
to do when true is returned after executing a passthrough command).  Fix this by
calling it in scsi_handle_rw_error.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-disk.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 4074d7c..e2c5408 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -473,10 +473,15 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
     }
 
     blk_error_action(s->qdev.conf.blk, action, is_read, error);
+    if (action == BLOCK_ERROR_ACTION_IGNORE) {
+        scsi_req_complete(&r->req, 0);
+        return true;
+    }
+
     if (action == BLOCK_ERROR_ACTION_STOP) {
         scsi_req_retry(&r->req);
     }
-    return action != BLOCK_ERROR_ACTION_IGNORE;
+    return false;
 }
 
 static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH 2/2] scsi-disk: fix rerror/werror=ignore

[Richard W.M. Jones]

On Sat, Oct 13, 2018 at 11:53:23AM +0200, Paolo Bonzini wrote:
> rerror=ignore was returning true from scsi_handle_rw_error but the callers were not
> calling scsi_req_complete when rerror=ignore returns true (this is the correct thing
> to do when true is returned after executing a passthrough command).  Fix this by
> calling it in scsi_handle_rw_error.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/scsi/scsi-disk.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
> index 4074d7c..e2c5408 100644
> --- a/hw/scsi/scsi-disk.c
> +++ b/hw/scsi/scsi-disk.c
> @@ -473,10 +473,15 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
>      }
>  
>      blk_error_action(s->qdev.conf.blk, action, is_read, error);
> +    if (action == BLOCK_ERROR_ACTION_IGNORE) {
> +        scsi_req_complete(&r->req, 0);
> +        return true;
> +    }
> +
>      if (action == BLOCK_ERROR_ACTION_STOP) {
>          scsi_req_retry(&r->req);
>      }
> -    return action != BLOCK_ERROR_ACTION_IGNORE;
> +    return false;
>  }

This commit seems to cause an assertion failure in qemu which is
trivial to reproduce:

(1) Create an NBD disk which returns EIO for every request:

  $ nbdkit -f -v --filter=error memory size=64M error-rate=100%

(2) Attach the disk to qemu as a virtio-scsi device:

  $ x86_64-softmmu/qemu-system-x86_64 -device virtio-scsi,id=scsi -drive file=nbd:localhost:10809,format=raw,id=hd0,if=none -device scsi-hd,drive=hd0
  qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed.

More details including a stack trace here:

  https://bugzilla.redhat.com/show_bug.cgi?id=1650975

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html