Re: [Qemu-devel] segfault in aio_bh_poll async.c:80 WAS: Re: kvm process disappears

[Stefan Priebe - Profihost AG]

Hi josh, hi Stefan,

> Am 14.05.2013 17:05, schrieb Stefan Hajnoczi:
>> On Tue, May 14, 2013 at 4:29 PM, Stefan Priebe - Profihost AG
>> <address@hidden> wrote:
>>> Am 10.05.2013 13:09, schrieb Stefan Hajnoczi:
>>>> On Fri, May 10, 2013 at 11:07 AM, Stefan Priebe - Profihost AG
>>>> <address@hidden> wrote:
>>>>> Am 10.05.2013 09:42, schrieb Stefan Hajnoczi:
>>>>>> On Fri, May 10, 2013 at 08:12:39AM +0200, Stefan Priebe - Profihost AG 
>>>>>> wrote:
>>>>>> 3. Either use gdb or an LD_PRELOAD library that catches exit(3) and
>>>>>>   _exit(2) and dumps core using abort(3).  Make sure core dumps are
>>>>>>   enabled.
>>> 
>>> This time i had a segfault Qemu 1.4.1 plus
>>> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dc7588c1eb3008bda53dde1d6b890cd299758155.
>>> 
>>> aio_bh_poll    async.c:80
>>> 
>>> Code...
>>> 
>>>   for (bh = ctx->first_bh; bh; bh = next) {
>>>        next = bh->next;
>>>        if (!bh->deleted && bh->scheduled) {
>>>            bh->scheduled = 0;
>>>            if (!bh->idle)
>>>                ret = 1;
>>>            bh->idle = 0;
>>>            bh->cb(bh->opaque);
>>>        }
>>>    }
>>> 
>>>    ctx->walking_bh--;
>>> 
>>>    /* remove deleted bhs */
>>>    if (!ctx->walking_bh) {
>>>        bhp = &ctx->first_bh;
>>>        while (*bhp) {
>>>            bh = *bhp;
>>> ===== THIS IS THE SEGFAULT LINE =====            if (bh->deleted) {
>>>                *bhp = bh->next;
>>>                g_free(bh);
>>>            } else {
>>>                bhp = &bh->next;
>>>            }
>>>        }
>>>    }
>>> 
>>>    return ret;
>> 
>> Interesting crash.  Do you have the output of "thread apply all bt"?
>> 
>> I would try looking at the AioContext using "p *ctx", and print out
>> the ctx->first_bh linked list.
> 
> Hi,
> 
> as i can't reproduce no ;-( i just saw the kernel segfault message and
> used addr2line and a qemu dbg package to get the code line.

I've now seen this again for two or three times. It always happens when we do 
an fstrim inside the guest.

And I've seen this first since josh async rbd patch.

Stefan



> 
> Stefan