Bug 1058173

Summary: qemu-kvm core dump booting guest with scsi-generic disk attached when using built-in iscsi driver
Product: Red Hat Enterprise Linux 7 Reporter: Fam Zheng <famz>
Component: qemu-kvmAssignee: Fam Zheng <famz>
Status: CLOSED CURRENTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 7.0CC: acathrow, areis, famz, hhuang, juzhang, knoel, myamazak, sluo, virt-maint
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: qemu-kvm-1.5.3-55.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 09:59:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 860099, 1025342, 1070056    

Description Fam Zheng 2014-01-27 07:20:17 UTC
Description of problem:

Sense buffer in the scsi device emulation code is not big enough to handle backend returned value, which triggers assertion and cause qemu-kvm to core dump.

Version-Release number of selected component (if applicable):

Host:
kernel 3.10.0-78.el7.x86_64
qemu-kvm-1.5.3-41.el7
libiscsi: 1.9.0
targetd: 0.6.1

How reproducible:
100%

Steps to Reproduce:
1.Use built-in iscsi backend driver, attach an scsi-generic device and boot the guest with Fedora live CD iso:

/usr/libexec/qemu-kvm -cdrom Fedora-Live-Desktop-x86_64-19-1.iso -drive file=iscsi://10.66.6.33:3260/iqn.2003-01.org.linux-iscsi.fam-ad.x8664:sn.a618f43a18d9/0,if=none,id=drive-disk -device virtio-scsi-pci,id=scsi1,bus=pci.0,addr=0x6 -device scsi-generic,drive=drive-disk,bus=scsi1.0,id=iscsi-disk -vnc :1 -boot d -enable-kvm -m 2048

2. Start booting the live CD os.

3. Wait for a few seconds for the guest to start to initialize devices.

Actual results:
core dump:

qemu-kvm: hw/scsi/scsi-bus.c:1629: scsi_req_complete: Assertion `req->sense_len <= sizeof(req->sense)' failed.
Aborted (core dumped)

Expected results:
Guest should start normally.

Additional info:
Possible fix posted to upstream:

[PATCH] scsi: Change scsi sense buf size to 252
http://lists.gnu.org/archive/html/qemu-devel/2014-01/msg03133.html

Comment 4 Miroslav Rezanina 2014-03-19 13:06:17 UTC
Fix included in qemu-kvm-1.5.3-55.el7

Comment 6 Karen Noel 2014-03-21 21:19:17 UTC
*** Bug 1078066 has been marked as a duplicate of this bug. ***

Comment 7 Sibiao Luo 2014-03-24 08:34:58 UTC
Reproduce this issue with the instruction of famz that this issue just was trigged by the LIO with fileio type setup by targetcli.

host info:
# uname -r && rpm -q qemu-kvm
3.10.0-113.el7.x86_64
qemu-kvm-1.5.3-53.el7.x86_64
targetcli-2.1.fb34-1.el7.noarch
guest info:
RHEL-7.0-20131030.1-Server-x86_64-dvd1.iso

Steps:
1.# yum install targetcli
2.Configuration an iSCSI target by creating an backing device with fileio type.
/iscsi> ls
o- iscsi .............................................................................................................. [Targets: 1]
  o- iqn.2003-01.org.linux-iscsi.dhcp-8-202.x8664:sn.10b139e7a94e ........................................................ [TPGs: 1]
    o- tpg1 .................................................................................................... [gen-acls, no-auth]
      o- acls ............................................................................................................ [ACLs: 0]
      o- luns ............................................................................................................ [LUNs: 1]
      | o- lun0 ................................................................................ [fileio/b0 (/home/iscsitarget.img)]
      o- portals ...................................................................................................... [Portals: 1]
        o- 10.66.8.202:3261 ................................................................................................... [OK]
/backstores> ls
o- backstores ................................................................................................................ [...]
  o- block .................................................................................................... [Storage Objects: 0]
  o- fileio ................................................................................................... [Storage Objects: 1]
  | o- b0 ................................................................... [/home/iscsitarget.img (10.0GiB) write-back activated]
  o- pscsi .................................................................................................... [Storage Objects: 0]
  o- ramdisk .................................................................................................. [Storage Objects: 0]
3.set auth mode.
/iscsi/iqn.20...39e7a94e/tpg1> set attribute generate_node_acls=1
/iscsi/iqn.20...39e7a94e/tpg1> set attribute authentication=0
4.discover the iSCSI LUN.
# iscsiadm --mode discovery --type sendtargets --portal 10.66.8.202:3261 --discover
10.66.8.202:3261,1 iqn.2003-01.org.linux-iscsi.dhcp-8-202.x8664:sn.10b139e7a94e
5.setup a QEMU with the iSCSI LUN specify.
e.g:# /usr/libexec/qemu-kvm -spice disable-ticketing,port=5931 -monitor stdio -drive file=iscsi://10.66.8.202:3261/iqn.2003-01.org.linux-iscsi.dhcp-8-202.x8664:sn.10b139e7a94e/0,if=none,id=drive-data-disk -iscsi id=iqn1,user=,password= -device virtio-scsi-pci,id=scsi1,bus=pci.0,addr=0x7 -device scsi-generic,drive=drive-data-disk,bus=scsi1.0,id=data-disk,bootindex=0 -cdrom RHEL-7.0-20131030.1-Server-x86_64-dvd1.iso -boot menu=on -enable-kvm -m 2048

Results:
after step 4, QEMU core dumped.
(qemu) main_channel_link: add main channel client
main_channel_handle_parsed: net test: latency 0.804000 ms, bitrate 25600000000 bps (24414.062500 Mbps)
inputs_connect: inputs channel client create
red_dispatcher_set_cursor_peer: 
qemu-kvm: hw/scsi/scsi-bus.c:1631: scsi_req_complete: Assertion `req->sense_len <= sizeof(req->sense)' failed.
Aborted (core dumped)

Verify this issue with the same steps.
host info:
# uname -r && rpm -q qemu-kvm
3.10.0-113.el7.x86_64
qemu-kvm-1.5.3-55.el7.x86_64

Results:
QEMU did not core dumped with 'qemu-kvm: hw/scsi/scsi-bus.c:1631: scsi_req_complete: Assertion `req->sense_len <= sizeof(req->sense)' failed.' any more but will meet bug 1079876 which i separate a new bug.

Base on above, this issue has been fixed correctly, move to VERIFIED status.

Best Regards,
sluo

Comment 8 Ludek Smid 2014-06-13 09:59:56 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.