Bug 2021778

Description of problem:
Qemu core dump when do full backup during system reset

Version-Release number of selected component (if applicable):
Kernel version:4.18.0-348.4.el8.kpq0.x86_64
qemu-kvm version:qemu-kvm-6.1.0-4.module+el8.6.0+13039+4b81a1dc


How reproducible:
20%


Steps to Reproduce:
1.Start guest with qemu cmd:
   /usr/libexec/qemu-kvm \
   -S  \
   -name 'avocado-vt-vm1'  \
   -sandbox on  \
   -machine q35,memory-backend=mem-machine_mem \
   -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
   -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
   -nodefaults \
   -device VGA,bus=pcie.0,addr=0x2 \
   -m 30720 \
   -object memory-backend-ram,size=30720M,id=mem-machine_mem  \
   -smp 10,maxcpus=10,cores=5,threads=1,dies=1,sockets=2  \
   -cpu 'Cascadelake-Server-noTSX',+kvm_pv_unhalt \
   -chardev socket,wait=off,server=on,id=qmp_id_qmpmonitor1,path=/tmp/avocado_oxpfhqt7/monitor-qmpmonitor1-20211110-012521-TNCkxDmn  \
   -mon chardev=qmp_id_qmpmonitor1,mode=control \
   -chardev socket,wait=off,server=on,id=qmp_id_catch_monitor,path=/tmp/avocado_oxpfhqt7/monitor-catch_monitor-20211110-012521-TNCkxDmn  \
   -mon chardev=qmp_id_catch_monitor,mode=control \
   -device pvpanic,ioport=0x505,id=idgKHYrQ \
   -chardev socket,wait=off,server=on,id=chardev_serial0,path=/tmp/avocado_oxpfhqt7/serial-serial0-20211110-012521-TNCkxDmn \
   -device isa-serial,id=serial0,chardev=chardev_serial0  \
   -chardev socket,id=seabioslog_id_20211110-012521-TNCkxDmn,path=/tmp/avocado_oxpfhqt7/seabios-20211110-012521-TNCkxDmn,server=on,wait=off \
   -device isa-debugcon,chardev=seabioslog_id_20211110-012521-TNCkxDmn,iobase=0x402 \
   -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
   -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
   -device pcie-root-port,id=pcie-root-device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
   -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
   -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
   -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel860-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
   -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
   -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
   -blockdev node-name=file_src1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/root/avocado/data/avocado-vt/sr1.qcow2,cache.direct=on,cache.no-flush=off \
   -blockdev node-name=drive_src1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_src1 \
   -device scsi-hd,id=src1,drive=drive_src1,write-cache=on \
   -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
   -device virtio-net-pci,mac=9a:11:64:b0:5d:a8,id=idxnEEYY,netdev=idBjpylo,bus=pcie-root-port-3,addr=0x0  \
   -netdev tap,id=idBjpylo,vhost=on,vhostfd=22,fd=11  \
   -vnc :0  \
   -rtc base=utc,clock=host,driftfix=slew  \
   -boot menu=off,order=cdn,once=c,strict=off \
   -enable-kvm \
   -device pcie-root-port,id=pcie_extra_root_port_0,multifunction=on,bus=pcie.0,addr=0x3,chassis=5
     
2. Create backup target node:
    {'execute': 'blockdev-create', 'arguments': {'options': {'driver': 'file', 'filename': '/root/avocado/data/avocado-vt/dst1.qcow2', 'size': 209715200}, 'job-id': 'file_dst1'}, 'id': 'Fk1bF3FV'}
    {'execute': 'job-dismiss', 'arguments': {'id': 'file_dst1'}, 'id': '13R5TDSj'}
    {'execute': 'blockdev-add', 'arguments': {'node-name': 'file_dst1', 'driver': 'file', 'filename': '/root/avocado/data/avocado-vt/dst1.qcow2', 'aio': 'threads', 'auto-read-only': True, 'discard': 'unmap'}, 'id': 'VIzrN0zy'}
    {'execute': 'blockdev-create', 'arguments': {'options': {'driver': 'qcow2', 'file': 'file_dst1', 'size': 209715200}, 'job-id': 'drive_dst1'}, 'id': 'YX8t8hBs'}
    {'execute': 'job-dismiss', 'arguments': {'id': 'drive_dst1'}, 'id': 'OTZwYb7J'}
    {'execute': 'blockdev-add', 'arguments': {'node-name': 'drive_dst1', 'driver': 'qcow2', 'file': 'file_dst1', 'read-only': False}, 'id': 'QHyUxtql'}

3. Reset system:
   {'execute': 'system_reset', 'id': 'OREutgnz'}
   {"return": {}, "id": "OREutgnz"}

4. During system reset, do full backup
   {'execute': 'blockdev-backup', 'arguments': {'device': 'drive_src1', 'target': 'drive_dst1', 'job-id': 'drive_src1_qnFF', 'sync': 'full', 'speed': 0, 'compress': False, 'auto-finalize': True, 'auto-dismiss': True, 'on-source-error': 'report', 'on-target-error': 'report'}, 'id': 'WbDARa8c'}
   {"timestamp": {"seconds": 1636525643, "microseconds": 980645}, "event": "RESET", "data": {"guest": false, "reason": "host-qmp-system-reset"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 981386}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 981429}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 981454}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 981478}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "drive_src1_qnFF"}}
   {"return": {}, "id": "WbDARa8c"}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993102}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993153}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993187}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993208}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993265}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "drive_src1_qnFF", "len": 209715200, "offset": 209715200, "speed": 0, "type": "backup"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993293}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "drive_src1_qnFF"}}
   {"timestamp": {"seconds": 1636525643, "microseconds": 993313}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "drive_src1_qnFF"}}

Actual results:
After step4, qemu core dump with info:
  01:28:07 WARNI| Could not receive data from monitor    ([Errno 104] Connection reset by peer)
01:28:07 DEBUG| [stderr] INFO:root:[qemu output] /tmp/aexpect_r4ILV5js/aexpect-2lmeo0i1.sh: line 1: 392547 Segmentation fault      (core dumped) MALLOC_PERTURB_=1 /usr/libexec/qemu-kvm -S -name 'avocado-vt-vm1' -sandbox on -machine q35,memory-backend=mem-machine_mem -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0 -nodefaults ...

Coredump info as bellow:
 (gdb) bt
#0  0x00005579653d53f0 in bdrv_parent_drained_poll (ignore_bds_parents=false, ignore=0x0, bs=0x557967e6d5d0) at ../block/io.c:306
#1  bdrv_drain_poll (bs=0x557967e6d5d0, recursive=<optimized out>, ignore_parent=0x0, ignore_bds_parents=false) at ../block/io.c:306
#2  0x00005579653d5735 in bdrv_drain_poll_top_level (ignore_parent=0x0, recursive=false, bs=0x557967e6d5d0) at ../block/io.c:473
#3  bdrv_do_drained_begin (poll=true, ignore_bds_parents=false, parent=0x0, recursive=false, bs=0x557967e6d5d0) at ../block/io.c:473
#4  bdrv_do_drained_begin (bs=0x557967e6d5d0, recursive=<optimized out>, parent=0x0, ignore_bds_parents=<optimized out>, poll=<optimized out>) at ../block/io.c:439
#5  0x00005579653dfa3b in blk_drain (blk=0x557968fa24a0) at ../block/block-backend.c:1732
#6  0x00005579652075c7 in scsi_device_purge_requests (sdev=sdev@entry=0x557968fa20b0, sense=...) at ../hw/scsi/scsi-bus.c:1638
#7  0x000055796512f674 in scsi_disk_reset (dev=0x557968fa20b0) at ../hw/scsi/scsi-disk.c:2248
#8  0x00005579653a926d in qdev_reset_one (dev=<optimized out>, opaque=<optimized out>) at ../hw/core/qdev.c:303
#9  0x00005579653a6231 in qbus_walk_children (bus=<optimized out>, pre_devfn=0x5579653a7a10 <qdev_prereset>, pre_busfn=0x5579653a79f0 <qbus_prereset>, post_devfn=0x5579653a9260 <qdev_reset_one>, 
    post_busfn=0x5579653a80a0 <qbus_reset_one>, opaque=0x0) at ../hw/core/bus.c:54
#10 0x00005579653a87e6 in qbus_reset_all (bus=<optimized out>) at ../hw/core/qdev.c:333
#11 0x000055796532dc42 in virtio_scsi_reset (vdev=<optimized out>) at /usr/src/debug/qemu-kvm-6.1.0-4.module+el8.6.0+13039+4b81a1dc.x86_64/include/hw/qdev-core.h:210
#12 0x00005579652d0269 in virtio_reset (opaque=0x557968e92f00) at ../hw/virtio/virtio.c:1998
#13 0x00005579651dffeb in virtio_bus_reset (bus=bus@entry=0x557968e92e78) at ../hw/virtio/virtio-bus.c:100
#14 0x00005579651ebcc4 in virtio_pci_reset (qdev=<optimized out>) at ../hw/virtio/virtio-pci.c:1932
#15 0x00005579653a9f6b in resettable_phase_hold (obj=0x557968e8ac80, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:182
#16 0x00005579653a5f54 in bus_reset_child_foreach (obj=<optimized out>, cb=0x5579653a9ec0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97
#17 0x00005579653a9f38 in resettable_child_foreach (rc=0x557967c1cd50, type=RESET_TYPE_COLD, opaque=0x0, cb=0x5579653a9ec0 <resettable_phase_hold>, obj=0x557968dc9b20) at ../hw/core/resettable.c:96
#18 resettable_phase_hold (obj=0x557968dc9b20, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173
#19 0x00005579653a7beb in device_reset_child_foreach (obj=<optimized out>, cb=0x5579653a9ec0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366
#20 0x00005579653a9f38 in resettable_child_foreach (rc=0x557967d32df0, type=RESET_TYPE_COLD, opaque=0x0, cb=0x5579653a9ec0 <resettable_phase_hold>, obj=0x557968dc91c0) at ../hw/core/resettable.c:96
#21 resettable_phase_hold (obj=0x557968dc91c0, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173
#22 0x00005579653a5f54 in bus_reset_child_foreach (obj=<optimized out>, cb=0x5579653a9ec0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97
#23 0x00005579653a9f38 in resettable_child_foreach (rc=0x557967c1cd50, type=RESET_TYPE_COLD, opaque=0x0, cb=0x5579653a9ec0 <resettable_phase_hold>, obj=0x557967fc02e0) at ../hw/core/resettable.c:96
#24 resettable_phase_hold (obj=0x557967fc02e0, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173
#25 0x00005579653a7beb in device_reset_child_foreach (obj=<optimized out>, cb=0x5579653a9ec0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366
#26 0x00005579653a9f38 in resettable_child_foreach (rc=0x557967c996c0, type=RESET_TYPE_COLD, opaque=0x0, cb=0x5579653a9ec0 <resettable_phase_hold>, obj=0x557967f82410) at ../hw/core/resettable.c:96
#27 resettable_phase_hold (obj=0x557967f82410, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173
#28 0x00005579653a5f54 in bus_reset_child_foreach (obj=<optimized out>, cb=0x5579653a9ec0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97
#29 0x00005579653a9f38 in resettable_child_foreach (rc=0x557967ccc240, type=RESET_TYPE_COLD, opaque=0x0, cb=0x5579653a9ec0 <resettable_phase_hold>, obj=0x557967d58890) at ../hw/core/resettable.c:96
#30 resettable_phase_hold (obj=obj@entry=0x557967d58890, opaque=opaque@entry=0x0, type=type@entry=RESET_TYPE_COLD) at ../hw/core/resettable.c:173
#31 0x00005579653aa119 in resettable_assert_reset (obj=0x557967d58890, type=<optimized out>) at ../hw/core/resettable.c:60
#32 0x00005579653aa1e5 in resettable_reset (obj=0x557967d58890, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:45
#33 0x00005579653a9d12 in qemu_devices_reset () at ../hw/core/reset.c:69
#34 0x000055796527754f in pc_machine_reset (machine=<optimized out>) at ../hw/i386/pc.c:1945
#35 0x00005579653600e1 in qemu_system_reset (reason=reason@entry=SHUTDOWN_CAUSE_GUEST_RESET) at ../softmmu/runstate.c:443
#36 0x00005579653607b8 in main_loop_should_exit () at ../softmmu/runstate.c:688
#37 qemu_main_loop () at ../softmmu/runstate.c:722
#38 0x0000557965111402 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ../softmmu/main.c:50