qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [Bug 1728635] Re: qemu-io crashes with SIGSEGV when did -c


From: R.Nageswara Sastry
Subject: [Qemu-devel] [Bug 1728635] Re: qemu-io crashes with SIGSEGV when did -c aio_write 9233408 28160 on a image_fuzzer image
Date: Mon, 30 Oct 2017 15:32:07 -0000

** Attachment added: "test.img tarred"
   
https://bugs.launchpad.net/qemu/+bug/1728635/+attachment/5000176/+files/test.img.tar.gz

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1728635

Title:
  qemu-io crashes with SIGSEGV when did  -c aio_write 9233408 28160 on a
  image_fuzzer image

Status in QEMU:
  New

Bug description:
  git is at HEAD a93ece47fd9edbd4558db24300056c9a57d3bcd4
  This is on ppc64le architecture.

  Re-production steps:

  1. Copy the attached file named test.img to a directory
  2. And customize the following command to point to the above directory and 
run the same.
  # cp test.img copy.img
  # qemu/qemu-io <path to>/copy.img -c "aio_write 9233408 28160"

  from gdb:
  Program terminated with signal 11, Segmentation fault.
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  Missing separate debuginfos, use: debuginfo-install 
cyrus-sasl-lib-2.1.26-21.el7.ppc64le glib2-2.50.3-3.el7.ppc64le 
glibc-2.17-196.el7.ppc64le gmp-6.0.0-15.el7.ppc64le gnutls-3.3.26-9.el7.ppc64le 
keyutils-libs-1.5.8-3.el7.ppc64le krb5-libs-1.15.1-8.el7.ppc64le 
libaio-0.3.109-13.el7.ppc64le libcom_err-1.42.9-10.el7.ppc64le 
libcurl-7.29.0-42.el7.ppc64le libffi-3.0.13-18.el7.ppc64le 
libgcc-4.8.5-16.el7_4.1.ppc64le libidn-1.28-4.el7.ppc64le 
libselinux-2.5-11.el7.ppc64le libssh2-1.4.3-10.el7_2.1.ppc64le 
libstdc++-4.8.5-16.el7_4.1.ppc64le libtasn1-4.10-1.el7.ppc64le 
nettle-2.7.1-8.el7.ppc64le nspr-4.13.1-1.0.el7_3.ppc64le 
nss-3.28.4-15.el7_4.ppc64le nss-softokn-freebl-3.28.3-8.el7_4.ppc64le 
nss-util-3.28.4-3.el7.ppc64le openldap-2.4.44-5.el7.ppc64le 
openssl-libs-1.0.2k-8.el7.ppc64le p11-kit-0.23.5-3.el7.ppc64le 
pcre-8.32-17.el7.ppc64le zlib-1.2.7-17.el7.ppc64le
  (gdb) bt
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  #1  0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, 
start_offset=137438953472, additional_clusters=0, exact_size=false, 
new_refblock_index=0,
      new_refblock_offset=524288) at block/qcow2-refcount.c:573
  #2  0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, 
cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
  #3  0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, 
length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
      at block/qcow2-refcount.c:834
  #4  0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) 
at block/qcow2-refcount.c:996
  #5  0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, 
guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
      at block/qcow2-cluster.c:1213
  #6  0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, 
host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1324
  #7  0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, 
offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, 
m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1511
  #8  0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
  #9  0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
  #10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, 
req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, 
flags=16)
      at block/io.c:1440
  #11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
  #12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
  #13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at 
block/block-backend.c:1276
  #14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at 
util/coroutine-ucontext.c:79
  #15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
  #16 0x0000000000000000 in ?? ()
  (gdb) bt full
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  No symbol table info available.
  #1  0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, 
start_offset=137438953472, additional_clusters=0, exact_size=false, 
new_refblock_index=0,
      new_refblock_offset=524288) at block/qcow2-refcount.c:573
          s = 0x25f63210
          total_refblock_count_u64 = 2
          additional_refblock_count = 0
          total_refblock_count = 2
          table_size = 65536
          area_reftable_index = 1
          table_clusters = 1
          i = 0
          table_offset = 268870620
          block_offset = 70367094634128
          end_offset = 636891296
          ret = 636786432
          new_table = 0x3fff9d940010
          __PRETTY_FUNCTION__ = "qcow2_refcount_area"
          data = {d64 = 636841824, d32 = 1}
          old_table_offset = 70367094634552
          old_table_size = 636786432
  #2  0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, 
cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
          s = 0x25f63210
          refcount_table_index = 0
          ret = 0
          new_block = 524288
          blocks_used = 1
          meta_offset = 137438953472
  #3  0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, 
length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
      at block/qcow2-refcount.c:834
          block_index = 268794524
          refcount = 4563798300
          cluster_index = 0
          table_index = 0
          s = 0x25f63210
          start = 0
          last = 0
          cluster_offset = 0
          refcount_block = 0x0
          old_table_index = -1
          ret = 0
  #4  0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) 
at block/qcow2-refcount.c:996
          offset = 0
          ret = 0
  #5  0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, 
guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
      at block/qcow2-cluster.c:1213
          cluster_offset = 0
          s = 0x25f63210
  #6  0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, 
host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1324
  ---Type <return> to continue, or q <return> to quit---
          s = 0x25f63210
          l2_index = 17
          l2_table = 0x0
          entry = 0
          nb_clusters = 1
          ret = 0
          keep_old_clusters = false
          alloc_cluster_offset = 0
          __PRETTY_FUNCTION__ = "handle_alloc"
          requested_bytes = 73651285856
          avail_bytes = -1649542304
          nb_bytes = 16383
          old_m = 0x3fff00000000
  #7  0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, 
offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, 
m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1511
          s = 0x25f63210
          start = 9233408
          remaining = 28160
          cluster_offset = 0
          cur_bytes = 28160
          ret = 0
          __PRETTY_FUNCTION__ = "qcow2_alloc_cluster_offset"
  #8  0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
          s = 0x25f63210
          offset_in_cluster = 320512
          ret = 0
          cur_bytes = 28160
          cluster_offset = 0
          hd_qiov = {iov = 0x25f285a0, niov = 0, nalloc = 1, size = 0}
          bytes_done = 0
          cluster_data = 0x0
          l2meta = 0x0
          __PRETTY_FUNCTION__ = "qcow2_co_pwritev"
  #9  0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
          drv = 0x102036f0 <bdrv_qcow2>
          sector_num = 636854560
          nb_sectors = 598850083
          ret = -1802855680
          __PRETTY_FUNCTION__ = "bdrv_driver_pwritev"
  #10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, 
req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, 
flags=16)
      at block/io.c:1440
          bs = 0x25f56f60
          drv = 0x102036f0 <bdrv_qcow2>
          waited = false
          ret = 0
          end_sector = 18089
          bytes_remaining = 28160
          max_transfer = 2147483647
          __PRETTY_FUNCTION__ = "bdrv_aligned_pwritev"
  #11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
  ---Type <return> to continue, or q <return> to quit---
          bs = 0x25f56f60
          req = {bs = 0x25f56f60, offset = 9233408, bytes = 28160, type = 
BDRV_TRACKED_WRITE, serialising = false, overlap_offset = 9233408,
            overlap_bytes = 28160, list = {le_next = 0x0, le_prev = 
0x25f5a1d8}, co = 0x25f65a90, wait_queue = {entries = {sqh_first = 0x0,
                sqh_last = 0x3fff9dadfe20}}, waiting_for = 0x0}
          align = 1
          head_buf = 0x0
          tail_buf = 0x0
          local_qiov = {iov = 0x3fff9dadfdb0, niov = -1649541648, nalloc = 
16383, size = 9233408}
          use_local_qiov = false
          ret = 0
          __PRETTY_FUNCTION__ = "bdrv_co_pwritev"
  #12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
          ret = 0
          bs = 0x25f56f60
  #13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at 
block/block-backend.c:1276
          acb = 0x25f6fa70
          rwco = 0x25f6fa98
          __PRETTY_FUNCTION__ = "blk_aio_write_entry"
  #14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at 
util/coroutine-ucontext.c:79
          arg = {p = 0x25f65a90, i = {636902032, 0}}
          self = 0x25f65a90
          co = 0x25f65a90
  #15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
  No symbol table info available.
  #16 0x0000000000000000 in ?? ()
  No symbol table info available.

  Will be attaching image_fuzzer image

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1728635/+subscriptions



reply via email to

[Prev in Thread] Current Thread [Next in Thread]