> Am 02.06.2014 um 15:40 schrieb Stefan Hajnoczi <stefa...@gmail.com>: > >> On Fri, May 30, 2014 at 04:10:39PM +0200, Stefan Priebe wrote: >> even with >> +From 271c0f68b4eae72691721243a1c37f46a3232d61 Mon Sep 17 00:00:00 2001 >> +From: Fam Zheng <f...@redhat.com> >> +Date: Wed, 21 May 2014 10:42:13 +0800 >> +Subject: [PATCH] aio: Fix use-after-free in cancellation path >> >> applied i saw today segfault with the following backtrace: >> >> Program terminated with signal 11, Segmentation fault. >> #0 0x00007f9dd633343f in event_notifier_set (e=0x124) at >> util/event_notifier-posix.c:97 >> 97 util/event_notifier-posix.c: No such file or directory. >> (gdb) bt >> #0 0x00007f9dd633343f in event_notifier_set (e=0x124) at >> util/event_notifier-posix.c:97 >> #1 0x00007f9dd5f4eafc in aio_notify (ctx=0x0) at async.c:246 >> #2 0x00007f9dd5f4e697 in qemu_bh_schedule (bh=0x7f9b98eeeb30) at async.c:128 >> #3 0x00007f9dd5fa2c44 in rbd_finish_aiocb (c=0x7f9dd9069ad0, >> rcb=0x7f9dd85f1770) at block/rbd.c:585 > > Hi Stefan, > Please print the QEMUBH: > (gdb) p *(QEMUBH*)0x7f9b98eeeb30 > > It would also be interesting to print out the qemu_aio_context->first_bh > linked list of QEMUBH structs to check whether 0x7f9b98eeeb30 is on the > list. > > The aio_bh_new() and aio_bh_schedule() APIs are supposed to be > thread-safe. In theory the rbd.c code is fine. But maybe there is a > race condition somewhere. > > If you want to debug interactively, ping me on #qemu on irc.oftc.net.
Hi, that would be great what's your username? On trip right now. Will be on irc in 4-5 hours or tomorrow in 16 hours. Greets, Stefan