From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 48B397FF44 for ; Tue, 16 Nov 2021 09:22:12 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 466FA13CE8 for ; Tue, 16 Nov 2021 09:22:12 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 9F68013CB3 for ; Tue, 16 Nov 2021 09:22:08 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id ACAA843AC1 for ; Tue, 16 Nov 2021 09:22:07 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pve-devel@lists.proxmox.com Date: Tue, 16 Nov 2021 09:22:02 +0100 Message-Id: <20211116082202.347149-1-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.261 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com] Subject: [pve-devel] [PATCH qemu] cherry-pick segfault fix X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Nov 2021 08:22:12 -0000 this was reported multiple times in our forums[1 with backtraces, 2 & 3 with same log messages], fix is taken from upstream master. 1: https://forum.proxmox.com/threads/pve-7-0-14-1-vm-not-running-live-migration-kills-vm-post-ssd-move-pre-ram-move.99704/ 2: https://forum.proxmox.com/threads/proxmox-7-0-14-1-crashes-vm-during-migrate-to-other-host.99678 3: https://forum.proxmox.com/threads/cannot-migrate-between-zfs-and-ceph.99685/#post-430152 Signed-off-by: Fabian Grünbichler --- gave it a quick spin with some NBD migrations, and the patch itselfs looks very straight-forward.. ...-NULL-pointer-dereference-in-mirror_.patch | 85 +++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 86 insertions(+) create mode 100644 debian/patches/extra/0007-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch diff --git a/debian/patches/extra/0007-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch b/debian/patches/extra/0007-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch new file mode 100644 index 0000000..f108313 --- /dev/null +++ b/debian/patches/extra/0007-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch @@ -0,0 +1,85 @@ +From 14889c02315b196f28b02832362dead64b015b6e Mon Sep 17 00:00:00 2001 +From: Stefano Garzarella +Date: Fri, 10 Sep 2021 14:45:33 +0200 +Subject: [PATCH qemu] block/mirror: fix NULL pointer dereference in + mirror_wait_on_conflicts() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +In mirror_iteration() we call mirror_wait_on_conflicts() with +`self` parameter set to NULL. + +Starting from commit d44dae1a7c we dereference `self` pointer in +mirror_wait_on_conflicts() without checks if it is not NULL. + +Backtrace: + Program terminated with signal SIGSEGV, Segmentation fault. + #0 mirror_wait_on_conflicts (self=0x0, s=, offset=, bytes=) + at ../block/mirror.c:172 + 172 self->waiting_for_op = op; + [Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))] + (gdb) bt + #0 mirror_wait_on_conflicts (self=0x0, s=, offset=, bytes=) + at ../block/mirror.c:172 + #1 0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=) at ../block/mirror.c:491 + #2 0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917 + #3 0x00005610c5f046c6 in coroutine_trampoline (i0=, i1=) + at ../util/coroutine-ucontext.c:173 + #4 0x00007f0909975820 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91 + from /usr/lib64/libc.so.6 + +Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404 +Fixes: d44dae1a7c ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts") +Signed-off-by: Stefano Garzarella +Message-Id: <20210910124533.288318-1-sgarzare@redhat.com> +Reviewed-by: Vladimir Sementsov-Ogievskiy +Signed-off-by: Hanna Reitz +(cherry picked from commit 66fed30c9cd11854fc878a4eceb507e915d7c9cd) +Signed-off-by: Fabian Grünbichler +--- + block/mirror.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/block/mirror.c b/block/mirror.c +index 33477ade1b..6a126d18c8 100644 +--- a/block/mirror.c ++++ b/block/mirror.c +@@ -162,18 +162,25 @@ static void coroutine_fn mirror_wait_on_conflicts(MirrorOp *self, + if (ranges_overlap(self_start_chunk, self_nb_chunks, + op_start_chunk, op_nb_chunks)) + { +- /* +- * If the operation is already (indirectly) waiting for us, or +- * will wait for us as soon as it wakes up, then just go on +- * (instead of producing a deadlock in the former case). +- */ +- if (op->waiting_for_op) { +- continue; ++ if (self) { ++ /* ++ * If the operation is already (indirectly) waiting for us, ++ * or will wait for us as soon as it wakes up, then just go ++ * on (instead of producing a deadlock in the former case). ++ */ ++ if (op->waiting_for_op) { ++ continue; ++ } ++ ++ self->waiting_for_op = op; + } + +- self->waiting_for_op = op; + qemu_co_queue_wait(&op->waiting_requests, NULL); +- self->waiting_for_op = NULL; ++ ++ if (self) { ++ self->waiting_for_op = NULL; ++ } ++ + break; + } + } +-- +2.30.2 + diff --git a/debian/patches/series b/debian/patches/series index c1eecec..92bcf10 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -4,6 +4,7 @@ extra/0003-monitor-hmp-add-support-for-flag-argument-with-value.patch extra/0004-monitor-refactor-set-expire_password-and-allow-VNC-d.patch extra/0005-monitor-hmp-correctly-invert-password-argument-detec.patch extra/0006-qxl-fix-pre-save-logic.patch +extra/0007-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch -- 2.30.2