Created attachment 448190 [details]
test.c

Description of problem:

SG_IO ioctl hangs forever on /dev/vda inside KVM virtual machine using virtio-blk

Version-Release number of selected component (if applicable):

kvm-83-164.el5_5.21 x86_64 (host)
kmod-kvm-83-164.el5_5.21 x86_64 (host)
kernel-2.6.18-194.11.3.el5 i686 (virtual machine)

How reproducible:

Always

Steps to Reproduce:

1. Start virtual machine with RHEL5 inside:
# /usr/libexec/qemu-kvm -name test -m 2048M \
-net nic,vlan=0,model=virtio,macaddr=00:76:AF:10:00:06 -net \
tap,vlan=0,script=/vm/ifup,downscript=/vm/ifdown -drive \
file=/dev/disk/by-id/scsi-3600605b000f4d2c0142154000c6d6523-part3,if=virtio,cache=none,index=0,media=disk,boot=on -vnc :1,password -boot c -smp 2 -balloon none -usb -usbdevice tablet
2. Log in virtual machine.
3. Compile and run attached example:
3a. # gcc -Wall -o test test.c
3b. # ./test

Actual results:

Hangs forever. Two minutes after start, the following info appears in logs:
INFO: task test:2366 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
test          D 00000093  2768  2366   2266                     (NOTLB)
       f79c1c20 00000082 e805411c 00000093 00000000 00000000 00000000 00000008 
       c23ffaa0 e80caa59 00000093 0007693d 00000000 c23ffbac c200c480 c2342040 
       f7f6201c 00000000 f7c60328 f881ccbc c23bc500 f881c025 f883e227 ffffffff 
Call Trace:
 [<f881c025>] vring_kick+0x25/0x26 [virtio_ring]
 [<f883e227>] do_virtblk_request+0x1b6/0x1be [virtio_blk]
 [<c061cc6b>] wait_for_completion+0x6b/0x8f
 [<c041f81b>] default_wake_function+0x0/0xc
 [<c04e14be>] blk_execute_rq+0x7d/0x97
 [<c04e0b53>] blk_end_sync_rq+0x0/0x1d
 [<c045b808>] mempool_alloc+0x28/0xc9
 [<c04e4dfd>] sg_io+0x270/0x355
 [<f884c26f>] __journal_file_buffer+0x10e/0x1e3 [jbd]
 [<c04e532c>] scsi_cmd_ioctl+0x1b9/0x365
 [<f884c26f>] __journal_file_buffer+0x10e/0x1e3 [jbd]
 [<c041ec40>] __wake_up+0x2a/0x3d
 [<c04e32cb>] blkdev_driver_ioctl+0x4b/0x5b
 [<c04e38f2>] blkdev_ioctl+0x617/0x665
 [<c048ee62>] mntput_no_expire+0x11/0x6a
 [<c04ed00a>] kobject_get+0xf/0x13
 [<c04e3e35>] get_disk+0x35/0x6e
 [<c04e3e75>] exact_lock+0x7/0xd
 [<c0560329>] kobj_lookup+0x10d/0x168
 [<c04e3940>] exact_match+0x0/0x4
 [<c04589cf>] find_get_page+0x18/0x3f
 [<c045b4fa>] filemap_nopage+0x19f/0x349
 [<c0464c02>] __handle_mm_fault+0x463/0xaac
 [<c047cade>] block_ioctl+0x13/0x16
 [<c047cacb>] block_ioctl+0x0/0x16
 [<c04861fd>] do_ioctl+0x1c/0x5d
 [<c0486791>] vfs_ioctl+0x47b/0x4d3
 [<c0476c47>] __fput+0x15c/0x184
 [<c044bece>] audit_syscall_entry+0x15a/0x18c
 [<c0486831>] sys_ioctl+0x48/0x5f
 [<c0404f17>] syscall_call+0x7/0xb
 =======================

Expected results:

Drive info like the following output:
# ./test /dev/hdc
Some of the INQUIRY command's response:
    QEMU      QEMU DVD-ROM      0.9.
INQUIRY duration=0 millisecs, resid=0

Additional info:

Example was taken from http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html