Bug 1937154 - [Negative test] 'block-stream' on a former 'block-commit' snapshot node could cause core dump
Summary: [Negative test] 'block-stream' on a former 'block-commit' snapshot node could...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux Advanced Virtualization
Classification: Red Hat
Component: qemu-kvm
Version: 8.4
Hardware: All
OS: Unspecified
medium
medium
Target Milestone: rc
: 8.4
Assignee: Kevin Wolf
QA Contact: aihua liang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-10 01:50 UTC by Gu Nini
Modified: 2021-11-16 08:16 UTC (History)
8 users (show)

Fixed In Version: qemu-kvm-6.0.0-16.module+el8.5.0+10848+2dccc46d
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-16 07:51:47 UTC
Type: ---
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
gdb_debug_info-03102021 (97.98 KB, text/plain)
2021-03-10 01:52 UTC, Gu Nini
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:4684 0 None None None 2021-11-16 07:52:21 UTC

Description Gu Nini 2021-03-10 01:50:09 UTC
Description of problem:
Create a snapshot from a base image to a snapshot one. Do block-commit from the snapshot image to the base one. Then after complete the block commit job, continue to do block-stream from the base image to the snapshot image errorly, then qemu core dumped:

# sh vm.sh
QEMU 5.2.0 monitor - type 'help' for more information
(qemu) 
(qemu) qemu-kvm: warning: kernel_irqchip allowed but unavailable: IRQ_XIVE capability must be present for KVM
Falling back to kernel-irqchip=off
Unexpected error in bdrv_check_update_perm() at ../block.c:2251:
Conflicts with use by image1 as 'root', which uses 'write' on drive_image1
vm11.sh: line 29: 221840 Aborted                 (core dumped) /usr/libexec/qemu-kvm -name 'avocado-vt-vm1' -sandbox on -machine pseries,x-svm-allowed=off -nodefaults -device VGA,bus=pci.0,addr=0x2 -m 1024 -smp 8,maxcpus=8,cores=4,threads=1,sockets=2 -cpu 'host' -chardev socket,id=qmp_id_qmpmonitor1,server,nowait,path=/var/tmp/avocado_1 -mon chardev=qmp_id_qmpmonitor1,mode=control -chardev socket,id=chardev_serial0,server,nowait,path=/var/tmp/avocado_2 -device spapr-vty,id=serial0,reg=0x30000000,chardev=chardev_serial0 -device qemu-xhci,id=usb1,bus=pci.0,addr=0x3 -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pci.0,addr=0x4.2,multifunction=on -device virtio-scsi-pci,id=virtio_scsi_pci1,bus=pci.0,addr=0x4.1 -blockdev node-name=file_image1,driver=file,aio=threads,filename=/home/ngu/rhel840-ppc64le-virtio-scsi.qcow2,auto-read-only=on,cache.direct=on,cache.no-flush=off -blockdev node-name=drive_image1,driver=qcow2,cache.direct=on,cache.no-flush=off,file=file_image1 -device scsi-hd,id=image1,drive=drive_image1,write-cache=on -device virtio-net-pci,mac=9a:fa:14:5e:3d:13,id=idLviSMj,netdev=idlrY22o,bus=pci.0,addr=0x5 -netdev tap,id=idlrY22o,vhost=on -vnc :0 -rtc base=utc,clock=host -boot menu=off,order=cdn,once=c,strict=off -enable-kvm -monitor stdio -device spapr-vscsi,id=scsi0,reg=0x00002000

Version-Release number of selected component (if applicable):
Host kernel: 4.18.0-295.el8.ppc64le
Guest kernel: 4.18.0-295.el8.ppc64le
Qemu: qemu-kvm-5.2.0-11.module+el8.4.0+10268+62bcbbed.ppc64le

How reproducible:
100%

Steps to Reproduce:
1. Boot up a vm:

    -blockdev node-name=file_image1,driver=file,aio=threads,filename=/home/ngu/rhel840-ppc64le-virtio-scsi.qcow2,auto-read-only=on,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \

2. 'blockdev-create/add' an image:

{'execute':'blockdev-create','arguments':{'options': {'driver':'file','filename':'/home/ngu/sn1','size':21474836480},'job-id':'job1'}}
{'execute':'blockdev-add','arguments':{'driver':'file','node-name':'drive_sn1','auto-read-only':true,'filename':'/home/ngu/sn1','discard':'unmap'}}
{'execute':'blockdev-create','arguments':{'options': {'driver': 'qcow2','file':'drive_sn1','size':21474836480, 'backing-file':'/home/ngu/rhel840-ppc64le-virtio-scsi.qcow2'},'job-id':'job2'}}
{'execute':'blockdev-add','arguments':{'driver':'qcow2','node-name':'sn1','file':'drive_sn1','read-only':false,'backing':null}}
{"return": {}}
{'execute':'job-dismiss','arguments':{'id':'job1'}}   {'execute':'job-dismiss','arguments':{'id':'job2'}}

3. Create a snapshot on the image:

{"execute":"transaction","arguments":{"actions":[{"type":"blockdev-snapshot","data":{"node":"drive_img1","overlay":"sn1"}}]}}

4. Do 'block-commit' from the snapshot image to base image:

{'execute': 'block-commit', 'arguments': { 'device':'sn1','job-id':'j1'}}

5. Complete the block commit job once it reaches ready status:

{"timestamp": {"seconds": 1615183735, "microseconds": 37727}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "j1"}}
{"timestamp": {"seconds": 1615183735, "microseconds": 37757}, "event": "BLOCK_JOB_READY", "data": {"device": "j1", "len": 0, "offset": 0, "speed": 0, "type": "commit"}}

{"execute":"job-complete","arguments":{"id":"j1"}}

6. Do block-stream from the base image to the snapshot image wrongly:

{execute': 'block-stream', 'arguments': { 'device':'sn1','job-id':'j1'}}


Actual results:
Qemu core dumped as showed in the bug description part


Expected results:
There is error prompt to forbidin the block-stream behavior instead of the core dump.

Additional info:

Comment 1 Gu Nini 2021-03-10 01:52:51 UTC
Created attachment 1762132 [details]
gdb_debug_info-03102021

Comment 8 aihua liang 2021-05-13 06:30:56 UTC
Test on qemu-kvm-6.0.0-16.module+el8.5.0+10848+2dccc46d, the bug has been fixed.

Test Env:
  kernel version:4.18.0-305.1.el8.x86_64
  qemu-kvm version:qemu-kvm-6.0.0-16.module+el8.5.0+10848+2dccc46d

Test Steps:
 1.Start guest with qemu cmds:
    /usr/libexec/qemu-kvm \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -machine q35 \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 30720  \
    -smp 10,maxcpus=10,cores=5,threads=1,dies=1,sockets=2  \
    -cpu 'Cascadelake-Server-noTSX',+kvm_pv_unhalt \
    -chardev socket,server=on,path=/tmp/monitor-qmpmonitor1-20210512-234257-mOeaMK07,id=qmp_id_qmpmonitor1,wait=off  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,server=on,path=/tmp/monitor-catch_monitor-20210512-234257-mOeaMK07,id=qmp_id_catch_monitor,wait=off  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=idXTMc9z \
    -chardev socket,server=on,path=/tmp/serial-serial0-20210512-234257-mOeaMK07,id=chardev_serial0,wait=off \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20210512-234257-mOeaMK07,path=/tmp/seabios-20210512-234257-mOeaMK07,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20210512-234257-mOeaMK07,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel850-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:bb:ed:35:8d:44,id=idSFYXRM,netdev=id47qtZ5,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=id47qtZ5,vhost=on  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -device pcie-root-port,id=pcie_extra_root_port_0,multifunction=on,bus=pcie.0,addr=0x3,chassis=5 \
    -monitor stdio \
    -qmp tcp:0:3000,server,nowait \

 2. Create snapshot node, and do snapshot
    #create snapshot node
     {'execute':'blockdev-add','arguments':{'driver':'file','node-name':'drive_sn1','filename':'/root/sn1'}}
     {'execute':'blockdev-create','arguments':{'options': {'driver': 'qcow2','file':'drive_sn1','size':21474836480,'backing-file':'/home/kvm_autotest_root/images/rhel76-64-virtio.qcow2','backing-fmt':'qcow2'},'job-id':'job2'}}
     {'execute':'blockdev-add','arguments':{'driver':'qcow2','node-name':'sn1','file':'drive_sn1','backing':null}}
     {'execute':'job-dismiss','arguments':{'id':'job1'}}
     {'execute':'job-dismiss','arguments':{'id':'job2'}}
   #do snapshot
     {'execute':'blockdev-snapshot','arguments':{'node':'drive_image1','overlay':'sn1'}}

 3. Do commit from sn1 to base
     {'execute': 'block-commit', 'arguments': { 'device':'sn1','job-id':'j1'}}
{"timestamp": {"seconds": 1620887050, "microseconds": 557795}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "j1"}}
{"timestamp": {"seconds": 1620887050, "microseconds": 557914}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "j1"}}
{"return": {}}
{"timestamp": {"seconds": 1620887050, "microseconds": 562944}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "j1"}}
{"timestamp": {"seconds": 1620887050, "microseconds": 562995}, "event": "BLOCK_JOB_READY", "data": {"device": "j1", "len": 2949120, "offset": 2949120, "speed": 0, "type": "commit"}}
 
 4. Complete commit job
    {"execute":"job-complete","arguments":{"id":"j1"}}
{"return": {}}
{"timestamp": {"seconds": 1620887061, "microseconds": 551421}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "j1"}}
{"timestamp": {"seconds": 1620887061, "microseconds": 551466}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "j1"}}
{"timestamp": {"seconds": 1620887061, "microseconds": 551532}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "j1", "len": 3145728, "offset": 3145728, "speed": 0, "type": "commit"}}
{"timestamp": {"seconds": 1620887061, "microseconds": 551566}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "j1"}}
{"timestamp": {"seconds": 1620887061, "microseconds": 551592}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "j1"}}

 5. Do stream on sn1
   {'execute': 'block-stream', 'arguments': { 'device':'sn1','job-id':'j1'}}
{"timestamp": {"seconds": 1620887090, "microseconds": 696654}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "j1"}}
{"timestamp": {"seconds": 1620887090, "microseconds": 696705}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "j1"}}
{"error": {"class": "GenericError", "desc": "Conflicts with use by image1 as 'root', which uses 'write' on drive_image1"}}

Comment 9 aihua liang 2021-05-13 06:32:35 UTC
As comment, set bug's status to "Verified".

Comment 11 errata-xmlrpc 2021-11-16 07:51:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (virt:av bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4684


Note You need to log in before you can comment on or make changes to this bug.