On Fri, May 30, 2014 at 04:10:39PM +0200, Stefan Priebe wrote: > even with > +From 271c0f68b4eae72691721243a1c37f46a3232d61 Mon Sep 17 00:00:00 2001 > +From: Fam Zheng <f...@redhat.com> > +Date: Wed, 21 May 2014 10:42:13 +0800 > +Subject: [PATCH] aio: Fix use-after-free in cancellation path > > applied i saw today segfault with the following backtrace: > > Program terminated with signal 11, Segmentation fault. > #0 0x00007f9dd633343f in event_notifier_set (e=0x124) at > util/event_notifier-posix.c:97 > 97 util/event_notifier-posix.c: No such file or directory. > (gdb) bt > #0 0x00007f9dd633343f in event_notifier_set (e=0x124) at > util/event_notifier-posix.c:97 > #1 0x00007f9dd5f4eafc in aio_notify (ctx=0x0) at async.c:246 > #2 0x00007f9dd5f4e697 in qemu_bh_schedule (bh=0x7f9b98eeeb30) at async.c:128 > #3 0x00007f9dd5fa2c44 in rbd_finish_aiocb (c=0x7f9dd9069ad0, > rcb=0x7f9dd85f1770) at block/rbd.c:585
Hi Stefan, Please print the QEMUBH: (gdb) p *(QEMUBH*)0x7f9b98eeeb30 It would also be interesting to print out the qemu_aio_context->first_bh linked list of QEMUBH structs to check whether 0x7f9b98eeeb30 is on the list. The aio_bh_new() and aio_bh_schedule() APIs are supposed to be thread-safe. In theory the rbd.c code is fine. But maybe there is a race condition somewhere. If you want to debug interactively, ping me on #qemu on irc.oftc.net. Stefan