[Qemu-devel] Re: qcow2 corruption observed, fixed by reverting old change

[Consul]

Consul wrote:
> Jamie Lokier wrote:
> > It was just for clarity.  If there are any bugs it's more likely to be
> > truncation on a 32 bit host :-)
> Maybe not a proper fix, do you see the same "corruption" with this patch?
> I don't know if it causes any memory leaks, but it certainly clears the 
> segfaults while running my old qcow2 windows images. Perhaps this is a 
> wrong place to free() or it needs a condition?
>
> $ svn diff block.c
> Index: block.c
> ===================================================================
> --- block.c     (revision 6618)
> +++ block.c     (working copy)
> @@ -1263,7 +1263,7 @@
>      if (!s->is_write) {
>          qemu_iovec_from_buffer(s->iov, s->bounce, s->iov->size);
>      }
> -    qemu_free(s->bounce);
> +    //qemu_free(s->bounce);
>      s->this_aiocb->cb(s->this_aiocb->opaque, ret);
>      qemu_aio_release(s->this_aiocb);
>  }

In fact, s->bounce == 0xf270000 looks suspicious to me.
Perhaps there is a 64/32 bit conversion error somewhere?


(gdb) Num     Type           Disp Enb Address    What
1       breakpoint     keep y   0x004035ac in qemu_bh_poll
                                       at c:/test/qemu/vl.c:3342
        stop only if bh->opaque==0xee9d440
(gdb) The program being debugged has been started already.
Start it from the beginning? (y or n) [answered Y; input not from terminal]
Starting program: c:\test\qemu/i386-softmmu/qemu.exe -L c:\\qemu-dist -hda 
C:\\qemu-img\\qem8D.tmp -m 512 -boot c -loadvm 1
[New thread 5188.0x180]
[New thread 5188.0xea0]
[New thread 5188.0x1608]

Breakpoint 1, qemu_bh_poll () at c:/test/qemu/vl.c:3342
3342                bh->cb(bh->opaque);
(gdb) #0  qemu_bh_poll () at c:/test/qemu/vl.c:3342
#1  0x00403a9a in main_loop_wait (timeout=0) at c:/test/qemu/vl.c:3745
#2  0x00407bf5 in main (argc=11, argv=0x3e27c0, envp=0xccc359ff)
    at c:/test/qemu/vl.c:3888
(gdb) qcow_aio_read_bh (opaque=0xee9d440) at block-qcow2.c:1194
1194        qemu_bh_delete(acb->bh);
(gdb) qemu_bh_delete (bh=0xe41b2f8) at c:/test/qemu/vl.c:3391
3391        bh->scheduled = 0;
(gdb) 3392          bh->deleted = 1;
(gdb) 3393      }
(gdb) qcow_aio_read_bh (opaque=0xee9d440) at block-qcow2.c:1195
1195        acb->bh = NULL;
(gdb) 1196          qcow_aio_read_cb(opaque, 0);
(gdb) qcow_aio_read_cb (opaque=0xee9d440, ret=0) at block-qcow2.c:1215
1215        QCowAIOCB *acb = opaque;
(gdb) 1216          BlockDriverState *bs = acb->common.bs;
(gdb) 1217          BDRVQcowState *s = bs->opaque;
(gdb) 1220          acb->hd_aiocb = NULL;
(gdb) 1221          if (ret < 0) {
(gdb) 1217          BDRVQcowState *s = bs->opaque;
(gdb) 1229          if (!acb->cluster_offset) {
(gdb) 1231          } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
(gdb) 1241          acb->nb_sectors -= acb->n;
(gdb) 1242          acb->sector_num += acb->n;
(gdb) 1243          acb->buf += acb->n * 512;
(gdb) 1245          if (acb->nb_sectors == 0) {
(gdb) 1247              acb->common.cb(acb->common.opaque, 0);
(gdb) qcow_aio_read_cb (opaque=0xee9d3d0, ret=0) at block-qcow2.c:1215
1215        QCowAIOCB *acb = opaque;
(gdb) 1216          BlockDriverState *bs = acb->common.bs;
(gdb) 1217          BDRVQcowState *s = bs->opaque;
(gdb) 1220          acb->hd_aiocb = NULL;
(gdb) 1221          if (ret < 0) {
(gdb) 1217          BDRVQcowState *s = bs->opaque;
(gdb) 1229          if (!acb->cluster_offset) {
(gdb) 1241          acb->nb_sectors -= acb->n;
(gdb) 1242          acb->sector_num += acb->n;
(gdb) 1243          acb->buf += acb->n * 512;
(gdb) 1245          if (acb->nb_sectors == 0) {
(gdb) 1247              acb->common.cb(acb->common.opaque, 0);
(gdb) bdrv_aio_rw_vector_cb (opaque=0xe41b2c8, ret=0) at block.c:1261
1261        VectorTranslationState *s = opaque;
(gdb) 1263          if (!s->is_write) {
(gdb) 1264              qemu_iovec_from_buffer(s->iov, s->bounce, s->iov->size);
(gdb) qemu_iovec_from_buffer (qiov=0xe412b9c, buf=0xf270000, count=512)
    at cutils.c:155
155         for (i = 0; i < qiov->niov && count; ++i) {
(gdb) 151           const uint8_t *p = (const uint8_t *)buf;
(gdb) 157               if (copy > qiov->iov[i].iov_len)
(gdb) 159               memcpy(qiov->iov[i].iov_base, p, copy);
(gdb) 160               p     += copy;
(gdb) 155           for (i = 0; i < qiov->niov && count; ++i) {
(gdb) 163       }
(gdb) bdrv_aio_rw_vector_cb (opaque=0xe41b2c8, ret=0) at block.c:1266
1266        qemu_free(s->bounce);
(gdb) qemu_free (ptr=0xf270000) at qemu-malloc.c:41
41          free(ptr);
(gdb)
Program received signal SIGSEGV, Segmentation fault.
0x7c96d811 in ntdll!RtlpNtMakeTemporaryKey () from C:\WINNT\system32\ntdll.dll