yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-block-backup-top-Don-t-acquire-context-while-droppin.patch

902636
From aefff389c4d11bd69180db7177135c4645a9b1bd Mon Sep 17 00:00:00 2001
902636
From: Sergio Lopez Pascual <slp@redhat.com>
902636
Date: Fri, 7 Feb 2020 11:27:46 +0000
902636
Subject: [PATCH 13/18] block/backup-top: Don't acquire context while dropping
902636
 top
902636
902636
RH-Author: Sergio Lopez Pascual <slp@redhat.com>
902636
Message-id: <20200207112749.25073-7-slp@redhat.com>
902636
Patchwork-id: 93759
902636
O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 6/9] block/backup-top: Don't acquire context while dropping top
902636
Bugzilla: 1745606 1746217 1773517 1779036 1782111 1782175 1783965
902636
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
902636
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
902636
RH-Acked-by: Max Reitz <mreitz@redhat.com>
902636
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
902636
All paths that lead to bdrv_backup_top_drop(), except for the call
902636
from backup_clean(), imply that the BDS AioContext has already been
902636
acquired, so doing it there too can potentially lead to QEMU hanging
902636
on AIO_WAIT_WHILE().
902636
902636
An easy way to trigger this situation is by issuing a two actions
902636
transaction, with a proper and a bogus blockdev-backup, so the second
902636
one will trigger a rollback. This will trigger a hang with an stack
902636
trace like this one:
902636
902636
 #0  0x00007fb680c75016 in __GI_ppoll (fds=0x55e74580f7c0, nfds=1, timeout=<optimized out>,
902636
     timeout@entry=0x0, sigmask=sigmask@entry=0x0) at ../sysdeps/unix/sysv/linux/ppoll.c:39
902636
 #1  0x000055e743386e09 in ppoll (__ss=0x0, __timeout=0x0, __nfds=<optimized out>, __fds=<optimized out>)
902636
     at /usr/include/bits/poll2.h:77
902636
 #2  0x000055e743386e09 in qemu_poll_ns
902636
     (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at util/qemu-timer.c:336
902636
 #3  0x000055e743388dc4 in aio_poll (ctx=0x55e7458925d0, blocking=blocking@entry=true)
902636
     at util/aio-posix.c:669
902636
 #4  0x000055e743305dea in bdrv_flush (bs=bs@entry=0x55e74593c0d0) at block/io.c:2878
902636
 #5  0x000055e7432be58e in bdrv_close (bs=0x55e74593c0d0) at block.c:4017
902636
 #6  0x000055e7432be58e in bdrv_delete (bs=<optimized out>) at block.c:4262
902636
 #7  0x000055e7432be58e in bdrv_unref (bs=bs@entry=0x55e74593c0d0) at block.c:5644
902636
 #8  0x000055e743316b9b in bdrv_backup_top_drop (bs=bs@entry=0x55e74593c0d0) at block/backup-top.c:273
902636
 #9  0x000055e74331461f in backup_job_create
902636
     (job_id=0x0, bs=bs@entry=0x55e7458d5820, target=target@entry=0x55e74589f640, speed=0, sync_mode=MIRROR_SYNC_MODE_FULL, sync_bitmap=sync_bitmap@entry=0x0, bitmap_mode=BITMAP_SYNC_MODE_ON_SUCCESS, compress=false, filter_node_name=0x0, on_source_error=BLOCKDEV_ON_ERROR_REPORT, on_target_error=BLOCKDEV_ON_ERROR_REPORT, creation_flags=0, cb=0x0, opaque=0x0, txn=0x0, errp=0x7ffddfd1efb0) at block/backup.c:478
902636
 #10 0x000055e74315bc52 in do_backup_common
902636
     (backup=backup@entry=0x55e746c066d0, bs=bs@entry=0x55e7458d5820, target_bs=target_bs@entry=0x55e74589f640, aio_context=aio_context@entry=0x55e7458a91e0, txn=txn@entry=0x0, errp=errp@entry=0x7ffddfd1efb0)
902636
     at blockdev.c:3580
902636
 #11 0x000055e74315c37c in do_blockdev_backup
902636
     (backup=backup@entry=0x55e746c066d0, txn=0x0, errp=errp@entry=0x7ffddfd1efb0)
902636
     at /usr/src/debug/qemu-kvm-4.2.0-2.module+el8.2.0+5135+ed3b2489.x86_64/./qapi/qapi-types-block-core.h:1492
902636
 #12 0x000055e74315c449 in blockdev_backup_prepare (common=0x55e746a8de90, errp=0x7ffddfd1f018)
902636
     at blockdev.c:1885
902636
 #13 0x000055e743160152 in qmp_transaction
902636
     (dev_list=<optimized out>, has_props=<optimized out>, props=0x55e7467fe2c0, errp=errp@entry=0x7ffddfd1f088) at blockdev.c:2340
902636
 #14 0x000055e743287ff5 in qmp_marshal_transaction
902636
     (args=<optimized out>, ret=<optimized out>, errp=0x7ffddfd1f0f8)
902636
     at qapi/qapi-commands-transaction.c:44
902636
 #15 0x000055e74333de6c in do_qmp_dispatch
902636
     (errp=0x7ffddfd1f0f0, allow_oob=<optimized out>, request=<optimized out>, cmds=0x55e743c28d60 <qmp_commands>) at qapi/qmp-dispatch.c:132
902636
 #16 0x000055e74333de6c in qmp_dispatch
902636
     (cmds=0x55e743c28d60 <qmp_commands>, request=<optimized out>, allow_oob=<optimized out>)
902636
     at qapi/qmp-dispatch.c:175
902636
 #17 0x000055e74325c061 in monitor_qmp_dispatch (mon=0x55e745908030, req=<optimized out>)
902636
     at monitor/qmp.c:145
902636
 #18 0x000055e74325c6fa in monitor_qmp_bh_dispatcher (data=<optimized out>) at monitor/qmp.c:234
902636
 #19 0x000055e743385866 in aio_bh_call (bh=0x55e745807ae0) at util/async.c:117
902636
 #20 0x000055e743385866 in aio_bh_poll (ctx=ctx@entry=0x55e7458067a0) at util/async.c:117
902636
 #21 0x000055e743388c54 in aio_dispatch (ctx=0x55e7458067a0) at util/aio-posix.c:459
902636
 #22 0x000055e743385742 in aio_ctx_dispatch
902636
     (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
902636
 #23 0x00007fb68543e67d in g_main_dispatch (context=0x55e745893a40) at gmain.c:3176
902636
 #24 0x00007fb68543e67d in g_main_context_dispatch (context=context@entry=0x55e745893a40) at gmain.c:3829
902636
 #25 0x000055e743387d08 in glib_pollfds_poll () at util/main-loop.c:219
902636
 #26 0x000055e743387d08 in os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
902636
 #27 0x000055e743387d08 in main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518
902636
 #28 0x000055e74316a3c1 in main_loop () at vl.c:1828
902636
 #29 0x000055e743016a72 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>)
902636
     at vl.c:4504
902636
902636
Fix this by not acquiring the AioContext there, and ensuring all paths
902636
leading to it have it already acquired (backup_clean()).
902636
902636
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1782111
902636
Signed-off-by: Sergio Lopez <slp@redhat.com>
902636
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
902636
(cherry picked from commit 0abf2581717a19d9749d5c2ff8acd0ac203452c2)
902636
Signed-off-by: Sergio Lopez <slp@redhat.com>
902636
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
902636
---
902636
 block/backup-top.c | 5 -----
902636
 block/backup.c     | 3 +++
902636
 2 files changed, 3 insertions(+), 5 deletions(-)
902636
902636
diff --git a/block/backup-top.c b/block/backup-top.c
902636
index 818d3f2..b8d863f 100644
902636
--- a/block/backup-top.c
902636
+++ b/block/backup-top.c
902636
@@ -255,9 +255,6 @@ append_failed:
902636
 void bdrv_backup_top_drop(BlockDriverState *bs)
902636
 {
902636
     BDRVBackupTopState *s = bs->opaque;
902636
-    AioContext *aio_context = bdrv_get_aio_context(bs);
902636
-
902636
-    aio_context_acquire(aio_context);
902636
 
902636
     bdrv_drained_begin(bs);
902636
 
902636
@@ -271,6 +268,4 @@ void bdrv_backup_top_drop(BlockDriverState *bs)
902636
     bdrv_drained_end(bs);
902636
 
902636
     bdrv_unref(bs);
902636
-
902636
-    aio_context_release(aio_context);
902636
 }
902636
diff --git a/block/backup.c b/block/backup.c
902636
index cf62b1a..1383e21 100644
902636
--- a/block/backup.c
902636
+++ b/block/backup.c
902636
@@ -135,8 +135,11 @@ static void backup_abort(Job *job)
902636
 static void backup_clean(Job *job)
902636
 {
902636
     BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
902636
+    AioContext *aio_context = bdrv_get_aio_context(s->backup_top);
902636
 
902636
+    aio_context_acquire(aio_context);
902636
     bdrv_backup_top_drop(s->backup_top);
902636
+    aio_context_release(aio_context);
902636
 }
902636
 
902636
 void backup_do_checkpoint(BlockJob *job, Error **errp)
902636
-- 
902636
1.8.3.1
902636