Unplugging SCSIDevices when virtio-scsi is using an IOThread suffers from race conditions: - scsi_device_purge_requests() is called from the IOThread in TMF emulation. This is unsafe, it should only be called from the BQL. - SCSIRequest->aiocb is not protected by a lock, so there are races between the main loop thread and the IOThread when scsi_device_purge_requests() runs in the main loop thread. - DMAAIOCB->acb is not protected by a lock, so there are races in the DMA helpers code when cancelling a request from the main loop thread.
These fixes solve assertion failures during SCSIDevice hot unplug in virtio-scsi with IOThread. Expanding the use of the AioContext lock isn't great since we're in the midst of trying to remove it. However, I think this solution is appropriate so that stable trees or distros can backport the fix without depending on QEMU multi-queue block layer refactoring. Special thanks to Qing Wang, who helped me iterate these patches because I couldn't reproduce the assertion failures myself. Stefan Hajnoczi (3): scsi: protect req->aiocb with AioContext lock dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race virtio-scsi: reset SCSI devices from main loop thread include/hw/virtio/virtio-scsi.h | 11 ++- hw/scsi/scsi-disk.c | 23 +++-- hw/scsi/scsi-generic.c | 11 ++- hw/scsi/virtio-scsi.c | 169 +++++++++++++++++++++++++------- softmmu/dma-helpers.c | 12 ++- 5 files changed, 171 insertions(+), 55 deletions(-) -- 2.39.1
