[Bug 1728635] Re: qemu-io crashes with SIGSEGV when did -c aio_write 9233408 28160 on a image_fuzzer image

[Thomas Huth]

The QEMU project is currently considering to move its bug tracking to another 
system. For this we need to know which bugs are still valid and which could be 
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state 
back to "New" within the next 60 days, otherwise this report will be marked as 
"Expired". Or mark it as "Fix Released" if the problem has been solved with a 
newer version of QEMU already. Thank you and sorry for the inconvenience.


** Changed in: qemu
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1728635

Title:
  qemu-io crashes with SIGSEGV when did  -c aio_write 9233408 28160 on a
  image_fuzzer image

Status in QEMU:
  Incomplete

Bug description:
  git is at HEAD a93ece47fd9edbd4558db24300056c9a57d3bcd4
  This is on ppc64le architecture.

  Re-production steps:

  1. Copy the attached file named test.img to a directory
  2. And customize the following command to point to the above directory and 
run the same.
  # cp test.img copy.img
  # qemu/qemu-io <path to>/copy.img -c "aio_write 9233408 28160"

  from gdb:
  Program terminated with signal 11, Segmentation fault.
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  Missing separate debuginfos, use: debuginfo-install 
cyrus-sasl-lib-2.1.26-21.el7.ppc64le glib2-2.50.3-3.el7.ppc64le 
glibc-2.17-196.el7.ppc64le gmp-6.0.0-15.el7.ppc64le gnutls-3.3.26-9.el7.ppc64le 
keyutils-libs-1.5.8-3.el7.ppc64le krb5-libs-1.15.1-8.el7.ppc64le 
libaio-0.3.109-13.el7.ppc64le libcom_err-1.42.9-10.el7.ppc64le 
libcurl-7.29.0-42.el7.ppc64le libffi-3.0.13-18.el7.ppc64le 
libgcc-4.8.5-16.el7_4.1.ppc64le libidn-1.28-4.el7.ppc64le 
libselinux-2.5-11.el7.ppc64le libssh2-1.4.3-10.el7_2.1.ppc64le 
libstdc++-4.8.5-16.el7_4.1.ppc64le libtasn1-4.10-1.el7.ppc64le 
nettle-2.7.1-8.el7.ppc64le nspr-4.13.1-1.0.el7_3.ppc64le 
nss-3.28.4-15.el7_4.ppc64le nss-softokn-freebl-3.28.3-8.el7_4.ppc64le 
nss-util-3.28.4-3.el7.ppc64le openldap-2.4.44-5.el7.ppc64le 
openssl-libs-1.0.2k-8.el7.ppc64le p11-kit-0.23.5-3.el7.ppc64le 
pcre-8.32-17.el7.ppc64le zlib-1.2.7-17.el7.ppc64le
  (gdb) bt
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  #1  0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, 
start_offset=137438953472, additional_clusters=0, exact_size=false, 
new_refblock_index=0,
      new_refblock_offset=524288) at block/qcow2-refcount.c:573
  #2  0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, 
cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
  #3  0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, 
length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
      at block/qcow2-refcount.c:834
  #4  0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) 
at block/qcow2-refcount.c:996
  #5  0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, 
guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
      at block/qcow2-cluster.c:1213
  #6  0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, 
host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1324
  #7  0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, 
offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, 
m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1511
  #8  0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
  #9  0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
  #10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, 
req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, 
flags=16)
      at block/io.c:1440
  #11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
  #12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
  #13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at 
block/block-backend.c:1276
  #14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at 
util/coroutine-ucontext.c:79
  #15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
  #16 0x0000000000000000 in ?? ()
  (gdb) bt full
  #0  0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
  No symbol table info available.
  #1  0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, 
start_offset=137438953472, additional_clusters=0, exact_size=false, 
new_refblock_index=0,
      new_refblock_offset=524288) at block/qcow2-refcount.c:573
          s = 0x25f63210
          total_refblock_count_u64 = 2
          additional_refblock_count = 0
          total_refblock_count = 2
          table_size = 65536
          area_reftable_index = 1
          table_clusters = 1
          i = 0
          table_offset = 268870620
          block_offset = 70367094634128
          end_offset = 636891296
          ret = 636786432
          new_table = 0x3fff9d940010
          __PRETTY_FUNCTION__ = "qcow2_refcount_area"
          data = {d64 = 636841824, d32 = 1}
          old_table_offset = 70367094634552
          old_table_size = 636786432
  #2  0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, 
cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
          s = 0x25f63210
          refcount_table_index = 0
          ret = 0
          new_block = 524288
          blocks_used = 1
          meta_offset = 137438953472
  #3  0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, 
length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
      at block/qcow2-refcount.c:834
          block_index = 268794524
          refcount = 4563798300
          cluster_index = 0
          table_index = 0
          s = 0x25f63210
          start = 0
          last = 0
          cluster_offset = 0
          refcount_block = 0x0
          old_table_index = -1
          ret = 0
  #4  0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) 
at block/qcow2-refcount.c:996
          offset = 0
          ret = 0
  #5  0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, 
guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
      at block/qcow2-cluster.c:1213
          cluster_offset = 0
          s = 0x25f63210
  #6  0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, 
host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1324
  ---Type <return> to continue, or q <return> to quit---
          s = 0x25f63210
          l2_index = 17
          l2_table = 0x0
          entry = 0
          nb_clusters = 1
          ret = 0
          keep_old_clusters = false
          alloc_cluster_offset = 0
          __PRETTY_FUNCTION__ = "handle_alloc"
          requested_bytes = 73651285856
          avail_bytes = -1649542304
          nb_bytes = 16383
          old_m = 0x3fff00000000
  #7  0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, 
offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, 
m=0x3fff9dadfb60)
      at block/qcow2-cluster.c:1511
          s = 0x25f63210
          start = 9233408
          remaining = 28160
          cluster_offset = 0
          cur_bytes = 28160
          ret = 0
          __PRETTY_FUNCTION__ = "qcow2_alloc_cluster_offset"
  #8  0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
          s = 0x25f63210
          offset_in_cluster = 320512
          ret = 0
          cur_bytes = 28160
          cluster_offset = 0
          hd_qiov = {iov = 0x25f285a0, niov = 0, nalloc = 1, size = 0}
          bytes_done = 0
          cluster_data = 0x0
          l2meta = 0x0
          __PRETTY_FUNCTION__ = "qcow2_co_pwritev"
  #9  0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
          drv = 0x102036f0 <bdrv_qcow2>
          sector_num = 636854560
          nb_sectors = 598850083
          ret = -1802855680
          __PRETTY_FUNCTION__ = "bdrv_driver_pwritev"
  #10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, 
req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, 
flags=16)
      at block/io.c:1440
          bs = 0x25f56f60
          drv = 0x102036f0 <bdrv_qcow2>
          waited = false
          ret = 0
          end_sector = 18089
          bytes_remaining = 28160
          max_transfer = 2147483647
          __PRETTY_FUNCTION__ = "bdrv_aligned_pwritev"
  #11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
  ---Type <return> to continue, or q <return> to quit---
          bs = 0x25f56f60
          req = {bs = 0x25f56f60, offset = 9233408, bytes = 28160, type = 
BDRV_TRACKED_WRITE, serialising = false, overlap_offset = 9233408,
            overlap_bytes = 28160, list = {le_next = 0x0, le_prev = 
0x25f5a1d8}, co = 0x25f65a90, wait_queue = {entries = {sqh_first = 0x0,
                sqh_last = 0x3fff9dadfe20}}, waiting_for = 0x0}
          align = 1
          head_buf = 0x0
          tail_buf = 0x0
          local_qiov = {iov = 0x3fff9dadfdb0, niov = -1649541648, nalloc = 
16383, size = 9233408}
          use_local_qiov = false
          ret = 0
          __PRETTY_FUNCTION__ = "bdrv_co_pwritev"
  #12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, 
bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
          ret = 0
          bs = 0x25f56f60
  #13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at 
block/block-backend.c:1276
          acb = 0x25f6fa70
          rwco = 0x25f6fa98
          __PRETTY_FUNCTION__ = "blk_aio_write_entry"
  #14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at 
util/coroutine-ucontext.c:79
          arg = {p = 0x25f65a90, i = {636902032, 0}}
          self = 0x25f65a90
          co = 0x25f65a90
  #15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
  No symbol table info available.
  #16 0x0000000000000000 in ?? ()
  No symbol table info available.

  Will be attaching image_fuzzer image

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1728635/+subscriptions