[Qemu-devel] About [PULL 20/25] block: Guard against NULL bs->drv

[Kangjie Xi]

Hi,

I encountered a qemu-nbd segfault, finally I found it was caused by
NULL bs-drv,  which is located in block/io.c function bdrv_co_flush
line 2377:

https://git.qemu.org/?p=qemu.git;a=blob;f=block/io.c;h=4fdf93a0144fa4761a14b8cc6b2a9a6b6e5d5bec;hb=d470ad42acfc73c45d3e8ed5311a491160b4c100#l2377

It is before the patch at line 2402, so the patch needs to be updated
to fix NULL bs-drv at line 2337.

https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg03425.html

> @@ -2373,6 +2399,12 @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
>      }
>
>      BLKDBG_EVENT(bs->file, BLKDBG_FLUSH_TO_DISK);
> +    if (!bs->drv) {
> +        /* bs->drv->bdrv_co_flush() might have ejected the BDS
> +         * (even in case of apparent success) */
> +        ret = -ENOMEDIUM;
> +        goto out;
> +    }
>      if (bs->drv->bdrv_co_flush_to_disk) {
>          ret = bs->drv->bdrv_co_flush_to_disk(bs);
>      } else if (bs->drv->bdrv_aio_flush) {

I have tested the latest qemu-2.11.0-rc2 and I am sure the qemu-nbd
segfault is caused by NULL bs-drv in block/io.c line 2337.

kernel: qemu-nbd[18768]: segfault at f8 ip 000055a24f7536a7 sp
00007f59b1137a40 error 4 in qemu-nbd[55a24f6d1000+188000]

However I have no methods to reproduce the segfault manually, the
qemu-nbd segfaut just occurs in my server cluster every week.

Thanks
-Kangjie