Bug 1582042 - Segfault on 'blockdev-mirror' with same node as source and target
Summary: Segfault on 'blockdev-mirror' with same node as source and target
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev
Version: 7.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Kevin Wolf
QA Contact: Gu Nini
URL:
Whiteboard:
Depends On:
Blocks: 1637963
TreeView+ depends on / blocked
 
Reported: 2018-05-24 05:12 UTC by Gu Nini
Modified: 2018-11-27 03:17 UTC (History)
13 users (show)

Fixed In Version: qemu-kvm-rhev-2.12.0-14.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1637963 (view as bug list)
Environment:
Last Closed: 2018-11-01 11:09:52 UTC
Target Upstream Version:


Attachments (Terms of Use)
The gdb info on 05242018 (14.18 KB, text/plain)
2018-05-24 05:14 UTC, Gu Nini
no flags Details

Description Gu Nini 2018-05-24 05:12:11 UTC
Description of problem:
Boot up a guest with a data disk, add an existed disk image with 'blockdev-add', do 'blockdev-snapshot' to the data disk, then do 'blockdev-mirror' to the same source/target disk, guest 'Segmentation fault  (core dumped)'.

Version-Release number of selected component (if applicable):
Host kernel: 3.10.0-888.el7.x86_64
Qemu-kvm-rhev: qemu-kvm-rhev-2.12.0-2.el7.x86_64
Guest kernel: 3.10.0-889.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Boot up a guest with a data disk 'drive_image2':

-drive id=drive_image2,if=none,snapshot=off,aio=threads,cache=none,format=qcow2,file=/home/hd1 \
-device scsi-hd,id=image2,drive=drive_image2 \

2. Create a disk image with the same size of above disk:
# qemu-img create -f qcow2 hd1.qcow2 2G

3. Add the created disk as 'drive2' with 'blockdev-add':

# nc -U /var/tmp/avocado1
{"QMP": {"version": {"qemu": {"micro": 0, "minor": 12, "major": 2}, "package": "qemu-kvm-rhev-2.12.0-2.el7"}, "capabilities": []}}
{"execute":"qmp_capabilities"}
{"return": {}}
{"execute":"blockdev-add","arguments":{"driver":"qcow2","node-name":"drive2","file":{"driver":"file","filename":"/home/hd1.qcow2"}}
}
{"return": {}}

4. Create snapshot for above 'drive_image2' on the new disk 'drive2':

{ "execute": "blockdev-snapshot", "arguments": { "node":"drive_image2","overlay":"drive2"}}
{"return": {}}

5. To do error handle test, continue to create a mirror for the 'drive_image2' on the same target disk 'drive2':

{ "execute": "blockdev-mirror","arguments":{"device":"drive_image2","target":"drive2","sync":"full"}}
Ncat: Connection reset by peer.


Actual results:
Segmentation fault  (core dumped) to the guest.

Expected results:
Error prompt as follows in qmp:
{"error": {"class": "GenericError", "desc": "The snapshot is already in use"}}
or
{"error": {"class": "GenericError", "desc": "Failed to get \"write\" lock"}}


Additional info:
1. If create mirror first then create a snapshot on the same target, there is following error prompt without other issues:
......
{ "execute": "block-job-complete","arguments":{"device":"drive_image2"}}
{"return": {}}
{"timestamp": {"seconds": 1527132274, "microseconds": 118837}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "drive_image2", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}}
{ "execute": "blockdev-snapshot", "arguments": { "node":"drive_image2","overlay":"drive2"}}
{"error": {"class": "GenericError", "desc": "The snapshot is already in use"}}

2. If do similar test using 'blockdev-snapshot-sync' and 'drive-mirror' instead, the error prompt is as follows without any other issue:

{ "execute": "blockdev-snapshot-sync", "arguments": { "device": "drive_image2","snapshot-file":"sn1","format":"qcow2","mode":"absolute-paths"}} 
{"return": {}}
 { "execute": "drive-mirror", "arguments": { "device": "drive_image2","target": "sn1", "format": "qcow2", "mode": "absolute-paths", "sync": "full"}}
{"error": {"class": "GenericError", "desc": "Failed to get \"write\" lock"}}

Comment 2 Gu Nini 2018-05-24 05:14:21 UTC
Created attachment 1440937 [details]
The gdb info on 05242018

Comment 3 Kevin Wolf 2018-08-07 16:17:38 UTC
The scenario can be considerably simplified. The problem is that at the end both 'drive_image2' and 'drive2' point to the same node and you're trying to mirror /home/hd1.qcow2 to itself.

The same case can be reproduced like this :

$ qemu-img create -f qcow2 /tmp/test.qcow2 64M
$ qemu-system-x86_64 -drive file=/tmp/overlay.qcow2,id=disk -qmp stdio
{"execute":"qmp_capabilities"}
{"execute":"blockdev-mirror","arguments":{"device":"disk","target":"disk","sync":"full"}}

Comment 9 Miroslav Rezanina 2018-09-11 12:37:09 UTC
Fix included in qemu-kvm-rhev-2.12.0-14.el7

Comment 10 Gu Nini 2018-09-12 01:48:16 UTC
Verify the bug on qemu-kvm-rhev-2.12.0-14.el7:

# nc -U /var/tmp/avocado1
{"QMP": {"version": {"qemu": {"micro": 0, "minor": 12, "major": 2}, "package": "qemu-kvm-rhev-2.12.0-14.el7"}, "capabilities": []}}
{"execute":"qmp_capabilities"}
{"return": {}}
{"execute":"blockdev-add","arguments":{"driver":"qcow2","node-name":"disk33","file":{"driver":"file","filename":"/home/hd33.qcow2"}}}
{"return": {}}
{"timestamp": {"seconds": 1536716756, "microseconds": 705448}, "event": "VSERPORT_CHANGE", "data": {"open": true, "id": "qemu-ga0"}}
{"timestamp": {"seconds": 1536716760, "microseconds": 565778}, "event": "NIC_RX_FILTER_CHANGED", "data": {"name": "id8e5D72", "path": "/machine/peripheral/id8e5D72/virtio-backend"}}
{ "execute": "blockdev-snapshot", "arguments": { "node":"drive_image3","overlay":"disk33"}}
{"return": {}}
{ "execute": "blockdev-mirror","arguments":{"device":"drive_image3","target":"disk33","sync":"full"}}
{"error": {"class": "GenericError", "desc": "Can't mirror node into itself"}}

Comment 12 errata-xmlrpc 2018-11-01 11:09:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3443


Note You need to log in before you can comment on or make changes to this bug.