I cannot reproduce your problem here. I have tried both with IDE and virtio
backed images and it is the same. The log below shows two accesses to
/dev/fakedevice - the difference is that the first one I did not have
write access to it, the second one I allowed write access.

Either case, everything works as expected for me:
qemu-kvm-0.12.1.2-2.147.el6.x86_64

Could you please try to reproduce this on an updated installation,
and close the bug if you don't see the problem.

Thanks,
Jes


[jes@batcave ~]$ /usr/libexec/qemu-kvm -enable-kvm -smp 1 -drive file=/tmp/f12.img,if=none,id=drive-ide0-0-0,boot=on,format=raw -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -uuid 17544ecc-d3a1-4d3c-a386-12daf50015f1 -usbdevice tablet  -rtc-td-hack   -balloon none -startdate now -name agentX -vga cirrus -monitor stdio -m 1024 -S -cpu qemu64 -vnc :0
Using CPU model "qemu64"
QEMU 0.12.1 monitor - type 'help' for more information
(qemu) info bl
block       blockstats  
(qemu) info block
drive-ide0-0-0: type=hd removable=0 file=/tmp/f12.img ro=0 drv=raw encrypted=0
floppy0: type=floppy removable=1 locked=0 [not inserted]
sd0: type=floppy removable=1 locked=0 [not inserted]
(qemu) snapshot_blkdev drive-ide0-0-0 /tmp/blah
Formatting '/tmp/blah', fmt=qcow2 size=10737418240 backing_file='/tmp/f12.img' backing_fmt='raw' encryption=off cluster_size=0 
(qemu) snapshot_blkdev drive-ide0-0-0 /root/foobar
Formatting '/root/foobar', fmt=qcow2 size=10737418240 backing_file='/tmp/blah' backing_fmt='qcow2' encryption=off cluster_size=0 
/root/foobar: error while creating qcow2: Permission denied
(qemu) snapshot_blkdev drive-ide0-0-0 /dev/fakedevice
Formatting '/dev/fakedevice', fmt=qcow2 size=10737418240 backing_file='/tmp/blah' backing_fmt='qcow2' encryption=off cluster_size=0 
/dev/fakedevice: error while creating qcow2: Permission denied
(qemu) snapshot_blkdev drive-ide0-0-0 /dev/fakedevice
Formatting '/dev/fakedevice', fmt=qcow2 size=10737418240 backing_file='/tmp/blah' backing_fmt='qcow2' encryption=off cluster_size=0 
/dev/fakedevice: error while creating qcow2: No such device or address
(qemu) [jes@batcave ~]$ rpm -q qemu-kvm
qemu-kvm-0.12.1.2-2.147.el6.x86_64
[jes@batcave ~]$ ls -al /dev/fakedevice
brw-rw-rw- 1 root root 199, 199 Feb 24 11:30 /dev/fakedevice
[jes@batcave ~]$

(In reply to comment #2)
> I cannot reproduce your problem here. I have tried both with IDE and virtio
> backed images and it is the same. The log below shows two accesses to
> /dev/fakedevice - the difference is that the first one I did not have
> write access to it, the second one I allowed write access.
> 
> Either case, everything works as expected for me:
> qemu-kvm-0.12.1.2-2.147.el6.x86_64
> 
> Could you please try to reproduce this on an updated installation,
> and close the bug if you don't see the problem.
> 
> Thanks,
> Jes

Hi, Jes

I can reproduce this issue with qemu-kvm-0.12.1.2-2.147.el6.x86_64.

This issue happens when I want to create snapshot to un-exist lvm as following:

(qemu) snapshot_blkdev drive-ide0-0-0 /dev/vgtest/testtt
Formatting '/dev/vgtest/testtt', fmt=qcow2 size=42949672960 backing_file='/home/rhel6.img' backing_fmt='qcow2' encryption=off cluster_size=0 
Aborted (core dumped)

This is no /dev/vgtest/testtt lvm exist.

Thanks, 
Shirley

Hi Shirley,

I don't understand what you mean by a non existing LVM entry.
Where does /dev/vgtest/testtt come from? What device node does
it have? (ls -l /dev/vgtest/testtt please)

Second, could you provide the strace output from this run?

Thanks,
Jes

(In reply to comment #4)
> Hi Shirley,
> 
> I don't understand what you mean by a non existing LVM entry.
> Where does /dev/vgtest/testtt come from? What device node does
> it have? (ls -l /dev/vgtest/testtt please)
> 
> Second, could you provide the strace output from this run?
> 
> Thanks,
> Jes

Hi, Jes
There is no /dev/vgtest/testtt in this host.
# lvs
  LV     VG     Attr   LSize  Origin Snap%  Move Log Copy%  Convert
  lvtest vgtest -wi-a- 16.52g
So I think when save snapshot to unexist disk, there should be error prompts "no such disk" but not abort.

Paste part of strace output, I wish it can help.

elect(19, [0 6 10 13 15 17 18], [], [], {1, 0}) = 1 (in [17], left {0, 999997})
read(17, "\16\0\0\0\0\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 128) = 128
rt_sigaction(SIGALRM, NULL, {0x40bbb0, ~[KILL STOP RTMIN RT_1], SA_RESTORER, 0x3be780f520}, 8) = 0
write(7, "\0", 1)                       = 1
write(16, "\1\0\0\0\0\0\0\0", 8)        = 8
read(17, 0x7fff67d700c0, 128)           = -1 EAGAIN (Resource temporarily unavailable)
timer_gettime(0, {it_interval={0, 0}, it_value={0, 0}}) = 0
timer_settime(0, 0, {it_interval={0, 0}, it_value={0, 19000000}}, NULL) = 0
select(19, [0 6 10 13 15 17 18], [], [], {1, 0}) = 2 (in [6 15], left {0, 999997})
read(15, "\1\0\0\0\0\0\0\0", 4096)      = 8
read(15, 0x7fff67d6f150, 4096)          = -1 EAGAIN (Resource temporarily unavailable)
read(6, "\0", 512)                      = 1
read(6, 0x7fff67d6ff50, 512)            = -1 EAGAIN (Resource temporarily unavailable)
select(19, [0 6 10 13 15 17 18], [], [], {1, 0}) = 1 (in [10], left {0, 988468})
read(10, "\f\0\0\0\0\0\0\0\0\0\0\0\232]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 128) = 128
select(19, [0 6 10 13 15 17 18], [], [], {1, 0}) = 1 (in [18], left {0, 999872})
read(18, "\1\0\0\0\0\0\0\0", 8)         = 8
futex(0x8e6044, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x8e6040, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
select(19, [0 6 10 13 15 17 18], [], [], {1, 0}) = 1 (in [0], left {0, 999993})
read(0, "\r", 1)                        = 1
write(1, "\r\n", 2)                     = 2
open("/dev/vgtest/testttt", O_RDONLY|O_NONBLOCK) = -1 ENOENT (No such file or directory)
stat("/dev/vgtest/testttt", 0x7fff67d6eef0) = -1 ENOENT (No such file or directory)
open("/dev/vgtest/testttt", O_RDONLY|O_NONBLOCK) = -1 ENOENT (No such file or directory)
stat("/dev/vgtest/testttt", 0x7fff67d6ee50) = -1 ENOENT (No such file or directory)
open("/dev/vgtest/lvtest", O_RDONLY|O_NONBLOCK) = 19
ioctl(19, CDROM_DRIVE_STATUS, 0x7fffffff) = -1 ENOTTY (Inappropriate ioctl for device)
close(19)                               = 0
stat("/dev/vgtest/lvtest", {st_mode=S_IFBLK|0660, st_rdev=makedev(253, 0), ...}) = 0
open("/dev/vgtest/lvtest", O_RDWR|O_DIRECT|O_CLOEXEC) = 19
lseek(19, 0, SEEK_END)                  = 17733517312
pread(19, "QFI\373\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\5\0\0\0\0"..., 512, 0) = 512
pread(19, "\200\0\0\0\0\4\0\0\200\0\0\0\7s\0\0\200\0\0\0\fU\0\0\200\0\0\0%R\0\0"..., 512, 65536) = 512
brk(0x366e000)                          = 0x366e000
brk(0x369e000)                          = 0x369e000
brk(0x36cf000)                          = 0x36cf000
brk(0x36ff000)                          = 0x36ff000
brk(0x372f000)                          = 0x372f000
brk(0x3750000)                          = 0x3750000
brk(0x3780000)                          = 0x3780000
mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0d473e6000
brk(0x37b0000)                          = 0x37b0000
pread(19, "\0\0\0\0\0\3\0\0\0\0\0\0\200\2\0\0\0\0\0\1\0\2\0\0\0\0\0\1\200\1\0\0"..., 65536, 131072) = 65536
pread(19, "QFI\373\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\5\0\0\0\0"..., 512, 0) = 512
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 9), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0dd7e9d000
write(1, "Formatting '/dev/vgtest/testttt'"..., 146) = 146
open("/dev/vgtest/testttt", O_WRONLY|O_CREAT|O_TRUNC, 0644) = 20
write(20, "QFI\373\0\0\0\2\0\0\0\0\0\0\0X\0\0\0\22\0\0\0\20\0\0\0\5\0\0\0\0"..., 72) = 72
write(20, "\342y*\312\0\0\0\5", 8)      = 8
write(20, "qcow2", 5)                   = 5
write(20, "\0\0\0", 3)                  = 3
write(20, "/dev/vgtest/lvtest", 18)     = 18
lseek(20, 65536, SEEK_SET)              = 65536
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
write(20, "\0\0\0\0\0\0\0\0", 8)        = 8
lseek(20, 131072, SEEK_SET)             = 131072
write(20, "\0\0\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536) = 65536
lseek(20, 196608, SEEK_SET)             = 196608
write(20, "\0\1\0\1\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536) = 65536
close(20)                               = 0
fdatasync(19)                           = 0
fdatasync(19)                           = 0
munmap(0x7f0d473e6000, 2101248)         = 0
close(19)                               = 0
fdatasync(9)                            = 0
fdatasync(9)                            = 0
fdatasync(9)                            = 0
fdatasync(9)                            = 0
fdatasync(9)                            = 0
munmap(0x7f0dd7a47000, 2101248)         = 0
close(9)                                = 0
munmap(0x7f0dd7c48000, 139264)          = 0
open("/dev/vgtest/testttt", O_RDONLY|O_NONBLOCK) = 9
ioctl(9, CDROM_DRIVE_STATUS, 0x7fffffff) = -1 ENOTTY (Inappropriate ioctl for device)
close(9)                                = 0
stat("/dev/vgtest/testttt", {st_mode=S_IFREG|0644, st_size=262144, ...}) = 0
open("/dev/vgtest/testttt", O_RDWR|O_DIRECT|O_CLOEXEC) = -1 EINVAL (Invalid argument)
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
tgkill(23962, 23962, SIGABRT)           = 0
--- SIGABRT (Aborted) @ 0 (0) ---
+++ killed by SIGABRT (core dumped) +++

Paste mount output here after talk with Jes via IRC.
# mount
/dev/sda2 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")
/dev/sda1 on /boot type ext4 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
/tmp on /tmp type none (rw,bind)
/var/tmp on /var/tmp type none (rw,bind)
/home on /home type none (rw,bind)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
nfsd on /proc/fs/nfsd type nfsd (rw)
gvfs-fuse-daemon on /root/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev)
You have new mail in /var/spool/mail/root

Additional info:

When create external snapshot for lvm to non-exist lvm, it is ok
# qemu-img create -f qcow2 -F qcow2 -b /dev/vgtest/lvtest  /dev/vgtest/haha
Formatting '/dev/vgtest/haha', fmt=qcow2 size=21474836480 backing_file='/dev/vgtest/lvtest' backing_fmt='qcow2' encryption=off cluster_size=0 

# qemu-img info /dev/vgtest/haha
image: /dev/vgtest/haha
file format: qcow2
virtual size: 20G (21474836480 bytes)
disk size: 144K
cluster_size: 65536
backing file: /dev/vgtest/lvtest (actual path: /dev/vgtest/lvtest)

While this snapshot can not be booted
# /usr/libexec/qemu-kvm  -M rhel6.1.0 -enable-kvm -m 4096 -smp 4,sockets=4,cores=1,threads=1 -name win08R2 -uuid df42b7a7-940f-ec54-6f4a-a14cdbbaf1d4 -nodefconfig -nodefaults -monitor stdio -rtc base=utc -boot order=dc,menu=off -drive file=/dev/vgtest/haha,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,werror=stop,rerror=stop -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0 
qemu: could not open disk image /dev/vgtest/haha: Invalid argument

Hi Shirley,

Could you try and see if you can reproduce the bug with this qemu-kvm
binary:

https://brewweb.devel.redhat.com/taskinfo?taskID=3153701

It should spit out an error message instead and go back to the old
image. If you test, please make sure to test that after the error
message, the guest is still able to operate and write to it's disk.

Thanks,
Jes

(In reply to comment #7)
> Hi Shirley,
> 
> Could you try and see if you can reproduce the bug with this qemu-kvm
> binary:
> 
> https://brewweb.devel.redhat.com/taskinfo?taskID=3153701
> 
> It should spit out an error message instead and go back to the old
> image. If you test, please make sure to test that after the error
> message, the guest is still able to operate and write to it's disk.
> 
> Thanks,
> Jes

Hi, Jes

Tried this issue with above build, get result as following:

(qemu) snapshot_blkdev drive-ide0-0-0 /dev/mapper/testseatet
Formatting '/dev/mapper/testseatet', fmt=qcow2 size=32212254720 backing_file='/mnt/win7.qcow2' backing_fmt='qcow2' encryption=off cluster_size=0 
Could not open '/dev/mapper/testseatet'
do_snapshot_blkdev(): Unable to open newly created snapshot file /dev/mapper/testseatet
                      attempting to revert to original image /mnt/win7.qcow2
(qemu) info block
drive-ide0-0-0: type=hd removable=0 file=/mnt/win7.qcow2 ro=0 drv=qcow2 encrypted=0
ide1-cd0: type=cdrom removable=1 locked=0 [not inserted]
floppy0: type=floppy removable=1 locked=0 [not inserted]
sd0: type=floppy removable=1 locked=0 [not inserted]

# ll /dev/mapper/testseatet 
-rw-r--r--. 1 root root 262144 Mar  3 04:51 /dev/mapper/testseatet

And guest is operational and can write data to disk.

BTW, I think if the snapshot fail to open, it is better to delete snapshot file /dev/mapper/testseatet.

Thanks for testing!

I will push a patch upstream for this. QEMU shouldn't try to
delete the new image file, it could be used for attacks which
we don't want. It is better to let the admin handle it.

Cheers,
Jes

Posted a fix for this one upstream - fix is confirmed to work by
Shirley Zhou.

Simple fix which only affects the error handling path, so proposing
for 6.1.

Jes

Reproduced on qemu-kvm-0.12.1.2-2.147.el6 as following steps.

Reproduce Procedure:
---------------------
1. boot a guest.
2. in qemu monitor:
   (qemu) snapshot_blkdev driver-ide-disk0 /dev/vgtest/unexist

Actual results:
----------------
After step 2, qemu-kvm: Aborted (core dumped)


Verify this bug on qemu-img-0.12.1.2-2.150.el6 as same steps above.

Actual results:
----------------
After step 2, qemu-kvm and guest works fine: 
(qemu) Could not open '/dev/vgtest/unexist'.


Conclusion:
-------------
According to results above, this bug has been resolved.

move to verified based on comment#15.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
New feature in 6.1, bug was in upstream and fixed - this is not customer exposed as the feature does not exist in a previous RHEL release.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0534.html

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0534.html