Re: [Qemu-devel] qemu 2.0 segfaults in event notifier

[Stefan Priebe - Profihost AG]

> Am 02.06.2014 um 15:40 schrieb Stefan Hajnoczi <address@hidden>:
> 
>> On Fri, May 30, 2014 at 04:10:39PM +0200, Stefan Priebe wrote:
>> even with
>> +From 271c0f68b4eae72691721243a1c37f46a3232d61 Mon Sep 17 00:00:00 2001
>> +From: Fam Zheng <address@hidden>
>> +Date: Wed, 21 May 2014 10:42:13 +0800
>> +Subject: [PATCH] aio: Fix use-after-free in cancellation path
>> 
>> applied i saw today segfault with the following backtrace:
>> 
>> Program terminated with signal 11, Segmentation fault.
>> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at 
>> util/event_notifier-posix.c:97
>> 97      util/event_notifier-posix.c: No such file or directory.
>> (gdb) bt
>> #0  0x00007f9dd633343f in event_notifier_set (e=0x124) at 
>> util/event_notifier-posix.c:97
>> #1  0x00007f9dd5f4eafc in aio_notify (ctx=0x0) at async.c:246
>> #2  0x00007f9dd5f4e697 in qemu_bh_schedule (bh=0x7f9b98eeeb30) at async.c:128
>> #3  0x00007f9dd5fa2c44 in rbd_finish_aiocb (c=0x7f9dd9069ad0, 
>> rcb=0x7f9dd85f1770) at block/rbd.c:585
> 
> Hi Stefan,
> Please print the QEMUBH:
> (gdb) p *(QEMUBH*)0x7f9b98eeeb30
> 
> It would also be interesting to print out the qemu_aio_context->first_bh
> linked list of QEMUBH structs to check whether 0x7f9b98eeeb30 is on the
> list.
> 
> The aio_bh_new() and aio_bh_schedule() APIs are supposed to be
> thread-safe.  In theory the rbd.c code is fine.  But maybe there is a
> race condition somewhere.
> 
> If you want to debug interactively, ping me on #qemu on irc.oftc.net.

Hi,

that would be great what's your username? On trip right now. Will be on irc in 
4-5 hours or tomorrow in 16 hours.

Greets,
Stefan