Re: [Qemu-devel] [Bug 1793791] [NEW] Crash with nbd_reply_chunk_iter_receive: Assertion `chunk->flags & NBD_REPLY_FLAG_DONE' failed

[Eric Blake]

On 9/21/18 11:42 AM, Matthew Schumacher wrote:
> Public bug reported:
>
> Qemu version on both sides: 2.12.1
> Host A Linux: 4.9.76
> Host B Linux: 4.14.67
>
> While calling from Host A:
> virsh migrate virtualmachine qemu+ssh://hostB/system --live --undefinesource 
> --persistent --verbose --copy-storage-all

Can you show the qemu command line generated by libvirt?

> I get a qemu crash with:
>
> 2018-09-21 16:12:23.073+0000: 14428: info : virObjectUnref:350 : OBJECT_UNREF: 
> obj=0x7f922c03d990
> qemu-system-x86_64: block/nbd-client.c:606: nbd_reply_chunk_iter_receive: Assertion 
> `chunk->flags & NBD_REPLY_FLAG_DONE' failed.

That assertion is the client complaining that it things the server has 
sent invalid data.

> 2018-09-21 16:12:41.230+0000: shutting down, reason=crashed
> 2018-09-21 16:12:52.900+0000: shutting down, reason=failed
>
> It doesn't do it every time, but most of the time.

Hmm - you're running under libvirt, so it's harder to inject command 
line options, but I'd be interested in figuring out how to enable trace 
output of nbd_* on both the server and the destination during the block 
migration portion of 'virsh migrate', to see if the tail of that trace 
when reproducing the failure gives any more insights into which side is 
breaking the protocol.  I'm also trying to inspect the code in 
nbd/server.c to see if the server can ever actually send a 
NBD_REPLY_TYPE_NONE packet without setting the NBD_REPLY_FLAG_DONE bit, 
which is what the assertion is complaining about.

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org