* [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response()
@ 2017-04-11 14:08 Kevin Wolf
2017-04-11 14:13 ` Max Reitz
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Kevin Wolf @ 2017-04-11 14:08 UTC (permalink / raw)
To: qemu-block; +Cc: kwolf, peter.maydell, mreitz, kchamart, pbonzini, qemu-devel
This fixes a regression introduced in commit 9d456654.
aio_co_wake() can only be used to reenter a coroutine that was already
previously entered, otherwise co->ctx is uninitialised and we access
garbage. Using it immediately after qemu_coroutine_create() like in
co_read_response() is wrong and causes segfaults.
Replace the call with aio_co_enter(), which gets an explicit AioContext
parameter and works even for new coroutines.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
---
block/sheepdog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 1b71fc8..142eb4f 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -942,7 +942,7 @@ static void co_read_response(void *opaque)
s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
}
- aio_co_wake(s->co_recv);
+ aio_co_enter(s->aio_context, s->co_recv);
}
static void co_write_request(void *opaque)
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response()
2017-04-11 14:08 [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response() Kevin Wolf
@ 2017-04-11 14:13 ` Max Reitz
2017-04-11 14:33 ` Kashyap Chamarthy
2017-04-11 15:46 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Max Reitz @ 2017-04-11 14:13 UTC (permalink / raw)
To: Kevin Wolf, qemu-block; +Cc: peter.maydell, kchamart, pbonzini, qemu-devel
[-- Attachment #1: Type: text/plain, Size: 738 bytes --]
On 11.04.2017 16:08, Kevin Wolf wrote:
> This fixes a regression introduced in commit 9d456654.
>
> aio_co_wake() can only be used to reenter a coroutine that was already
> previously entered, otherwise co->ctx is uninitialised and we access
> garbage. Using it immediately after qemu_coroutine_create() like in
> co_read_response() is wrong and causes segfaults.
>
> Replace the call with aio_co_enter(), which gets an explicit AioContext
> parameter and works even for new coroutines.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
> ---
> block/sheepdog.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Max Reitz <mreitz@redhat.com>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response()
2017-04-11 14:08 [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response() Kevin Wolf
2017-04-11 14:13 ` Max Reitz
@ 2017-04-11 14:33 ` Kashyap Chamarthy
2017-04-11 15:46 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Kashyap Chamarthy @ 2017-04-11 14:33 UTC (permalink / raw)
To: Kevin Wolf; +Cc: qemu-block, peter.maydell, mreitz, pbonzini, qemu-devel
On Tue, Apr 11, 2017 at 04:08:53PM +0200, Kevin Wolf wrote:
> This fixes a regression introduced in commit 9d456654.
>
> aio_co_wake() can only be used to reenter a coroutine that was already
> previously entered, otherwise co->ctx is uninitialised and we access
> garbage. Using it immediately after qemu_coroutine_create() like in
> co_read_response() is wrong and causes segfaults.
>
> Replace the call with aio_co_enter(), which gets an explicit AioContext
> parameter and works even for new coroutines.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
Thanks.
The test evidence was posted on IRC. But just for archives' sake, I was
here (on Git) when I applied this patch:
$ git describe
v2.9.0-rc3-45-gaa388dd
And that was the specific test:
$ qemu-img convert -t directsync \
./cirros-0.3.5.qcow2 sheepdog:cirros0.3.5vm
After applying this patch, the segfault is gone, and the `qemu-img convert`
happens successfully.
That was my Sheepdog environment:
https://kashyapc.fedorapeople.org/virt/sheepdog-qemu-corosync.txt
> ---
> block/sheepdog.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/sheepdog.c b/block/sheepdog.c
> index 1b71fc8..142eb4f 100644
> --- a/block/sheepdog.c
> +++ b/block/sheepdog.c
> @@ -942,7 +942,7 @@ static void co_read_response(void *opaque)
> s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
> }
>
> - aio_co_wake(s->co_recv);
> + aio_co_enter(s->aio_context, s->co_recv);
> }
>
> static void co_write_request(void *opaque)
> --
> 1.8.3.1
>
--
/kashyap
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response()
2017-04-11 14:08 [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response() Kevin Wolf
2017-04-11 14:13 ` Max Reitz
2017-04-11 14:33 ` Kashyap Chamarthy
@ 2017-04-11 15:46 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Peter Maydell @ 2017-04-11 15:46 UTC (permalink / raw)
To: Kevin Wolf
Cc: Qemu-block, Max Reitz, Kashyap Chamarthy, Paolo Bonzini, QEMU Developers
On 11 April 2017 at 15:08, Kevin Wolf <kwolf@redhat.com> wrote:
> This fixes a regression introduced in commit 9d456654.
>
> aio_co_wake() can only be used to reenter a coroutine that was already
> previously entered, otherwise co->ctx is uninitialised and we access
> garbage. Using it immediately after qemu_coroutine_create() like in
> co_read_response() is wrong and causes segfaults.
>
> Replace the call with aio_co_enter(), which gets an explicit AioContext
> parameter and works even for new coroutines.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
> ---
> block/sheepdog.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/sheepdog.c b/block/sheepdog.c
> index 1b71fc8..142eb4f 100644
> --- a/block/sheepdog.c
> +++ b/block/sheepdog.c
> @@ -942,7 +942,7 @@ static void co_read_response(void *opaque)
> s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
> }
>
> - aio_co_wake(s->co_recv);
> + aio_co_enter(s->aio_context, s->co_recv);
> }
>
> static void co_write_request(void *opaque)
> --
> 1.8.3.1
>
Applied, thanks.
-- PMM
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-04-11 15:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-11 14:08 [Qemu-devel] [PATCH for-2.9] sheepdog: Fix crash in co_read_response() Kevin Wolf
2017-04-11 14:13 ` Max Reitz
2017-04-11 14:33 ` Kashyap Chamarthy
2017-04-11 15:46 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.