1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
qemu-io crashes with SIGSEGV when did -c aio_write 9233408 28160 on a image_fuzzer image
git is at HEAD a93ece47fd9edbd4558db24300056c9a57d3bcd4
This is on ppc64le architecture.
Re-production steps:
1. Copy the attached file named test.img to a directory
2. And customize the following command to point to the above directory and run the same.
# cp test.img copy.img
# qemu/qemu-io <path to>/copy.img -c "aio_write 9233408 28160"
from gdb:
Program terminated with signal 11, Segmentation fault.
#0 0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.26-21.el7.ppc64le glib2-2.50.3-3.el7.ppc64le glibc-2.17-196.el7.ppc64le gmp-6.0.0-15.el7.ppc64le gnutls-3.3.26-9.el7.ppc64le keyutils-libs-1.5.8-3.el7.ppc64le krb5-libs-1.15.1-8.el7.ppc64le libaio-0.3.109-13.el7.ppc64le libcom_err-1.42.9-10.el7.ppc64le libcurl-7.29.0-42.el7.ppc64le libffi-3.0.13-18.el7.ppc64le libgcc-4.8.5-16.el7_4.1.ppc64le libidn-1.28-4.el7.ppc64le libselinux-2.5-11.el7.ppc64le libssh2-1.4.3-10.el7_2.1.ppc64le libstdc++-4.8.5-16.el7_4.1.ppc64le libtasn1-4.10-1.el7.ppc64le nettle-2.7.1-8.el7.ppc64le nspr-4.13.1-1.0.el7_3.ppc64le nss-3.28.4-15.el7_4.ppc64le nss-softokn-freebl-3.28.3-8.el7_4.ppc64le nss-util-3.28.4-3.el7.ppc64le openldap-2.4.44-5.el7.ppc64le openssl-libs-1.0.2k-8.el7.ppc64le p11-kit-0.23.5-3.el7.ppc64le pcre-8.32-17.el7.ppc64le zlib-1.2.7-17.el7.ppc64le
(gdb) bt
#0 0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
#1 0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, start_offset=137438953472, additional_clusters=0, exact_size=false, new_refblock_index=0,
new_refblock_offset=524288) at block/qcow2-refcount.c:573
#2 0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
#3 0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
at block/qcow2-refcount.c:834
#4 0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) at block/qcow2-refcount.c:996
#5 0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
at block/qcow2-cluster.c:1213
#6 0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
at block/qcow2-cluster.c:1324
#7 0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, m=0x3fff9dadfb60)
at block/qcow2-cluster.c:1511
#8 0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
#9 0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
#10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, flags=16)
at block/io.c:1440
#11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
#12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
#13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at block/block-backend.c:1276
#14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at util/coroutine-ucontext.c:79
#15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
#16 0x0000000000000000 in ?? ()
(gdb) bt full
#0 0x00003fffa0077644 in __memcpy_power7 () from /lib64/libc.so.6
No symbol table info available.
#1 0x0000000010056738 in qcow2_refcount_area (bs=0x25f56f60, start_offset=137438953472, additional_clusters=0, exact_size=false, new_refblock_index=0,
new_refblock_offset=524288) at block/qcow2-refcount.c:573
s = 0x25f63210
total_refblock_count_u64 = 2
additional_refblock_count = 0
total_refblock_count = 2
table_size = 65536
area_reftable_index = 1
table_clusters = 1
i = 0
table_offset = 268870620
block_offset = 70367094634128
end_offset = 636891296
ret = 636786432
new_table = 0x3fff9d940010
__PRETTY_FUNCTION__ = "qcow2_refcount_area"
data = {d64 = 636841824, d32 = 1}
old_table_offset = 70367094634552
old_table_size = 636786432
#2 0x0000000010056374 in alloc_refcount_block (bs=0x25f56f60, cluster_index=0, refcount_block=0x3fff9dadf838) at block/qcow2-refcount.c:479
s = 0x25f63210
refcount_table_index = 0
ret = 0
new_block = 524288
blocks_used = 1
meta_offset = 137438953472
#3 0x0000000010057520 in update_refcount (bs=0x25f56f60, offset=0, length=524288, addend=1, decrease=false, type=QCOW2_DISCARD_NEVER)
at block/qcow2-refcount.c:834
block_index = 268794524
refcount = 4563798300
cluster_index = 0
table_index = 0
s = 0x25f63210
start = 0
last = 0
cluster_offset = 0
refcount_block = 0x0
old_table_index = -1
ret = 0
#4 0x0000000010057c24 in qcow2_alloc_clusters (bs=0x25f56f60, size=524288) at block/qcow2-refcount.c:996
offset = 0
ret = 0
#5 0x0000000010063684 in do_alloc_cluster_offset (bs=0x25f56f60, guest_offset=9233408, host_offset=0x3fff9dadf9e0, nb_clusters=0x3fff9dadf9d8)
at block/qcow2-cluster.c:1213
cluster_offset = 0
s = 0x25f63210
#6 0x0000000010063afc in handle_alloc (bs=0x25f56f60, guest_offset=9233408, host_offset=0x3fff9dadfab0, bytes=0x3fff9dadfab8, m=0x3fff9dadfb60)
at block/qcow2-cluster.c:1324
---Type <return> to continue, or q <return> to quit---
s = 0x25f63210
l2_index = 17
l2_table = 0x0
entry = 0
nb_clusters = 1
ret = 0
keep_old_clusters = false
alloc_cluster_offset = 0
__PRETTY_FUNCTION__ = "handle_alloc"
requested_bytes = 73651285856
avail_bytes = -1649542304
nb_bytes = 16383
old_m = 0x3fff00000000
#7 0x0000000010064178 in qcow2_alloc_cluster_offset (bs=0x25f56f60, offset=9233408, bytes=0x3fff9dadfb4c, host_offset=0x3fff9dadfb58, m=0x3fff9dadfb60)
at block/qcow2-cluster.c:1511
s = 0x25f63210
start = 9233408
remaining = 28160
cluster_offset = 0
cur_bytes = 28160
ret = 0
__PRETTY_FUNCTION__ = "qcow2_alloc_cluster_offset"
#8 0x000000001004d3f4 in qcow2_co_pwritev (bs=0x25f56f60, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=0) at block/qcow2.c:1919
s = 0x25f63210
offset_in_cluster = 320512
ret = 0
cur_bytes = 28160
cluster_offset = 0
hd_qiov = {iov = 0x25f285a0, niov = 0, nalloc = 1, size = 0}
bytes_done = 0
cluster_data = 0x0
l2meta = 0x0
__PRETTY_FUNCTION__ = "qcow2_co_pwritev"
#9 0x00000000100a9648 in bdrv_driver_pwritev (bs=0x25f56f60, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=16) at block/io.c:898
drv = 0x102036f0 <bdrv_qcow2>
sector_num = 636854560
nb_sectors = 598850083
ret = -1802855680
__PRETTY_FUNCTION__ = "bdrv_driver_pwritev"
#10 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x25f627f0, req=0x3fff9dadfdd8, offset=9233408, bytes=28160, align=1, qiov=0x25f6fa08, flags=16)
at block/io.c:1440
bs = 0x25f56f60
drv = 0x102036f0 <bdrv_qcow2>
waited = false
ret = 0
end_sector = 18089
bytes_remaining = 28160
max_transfer = 2147483647
__PRETTY_FUNCTION__ = "bdrv_aligned_pwritev"
#11 0x00000000100ac4ac in bdrv_co_pwritev (child=0x25f627f0, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/io.c:1691
---Type <return> to continue, or q <return> to quit---
bs = 0x25f56f60
req = {bs = 0x25f56f60, offset = 9233408, bytes = 28160, type = BDRV_TRACKED_WRITE, serialising = false, overlap_offset = 9233408,
overlap_bytes = 28160, list = {le_next = 0x0, le_prev = 0x25f5a1d8}, co = 0x25f65a90, wait_queue = {entries = {sqh_first = 0x0,
sqh_last = 0x3fff9dadfe20}}, waiting_for = 0x0}
align = 1
head_buf = 0x0
tail_buf = 0x0
local_qiov = {iov = 0x3fff9dadfdb0, niov = -1649541648, nalloc = 16383, size = 9233408}
use_local_qiov = false
ret = 0
__PRETTY_FUNCTION__ = "bdrv_co_pwritev"
#12 0x000000001008da0c in blk_co_pwritev (blk=0x25f49410, offset=9233408, bytes=28160, qiov=0x25f6fa08, flags=BDRV_REQ_FUA) at block/block-backend.c:1085
ret = 0
bs = 0x25f56f60
#13 0x000000001008e718 in blk_aio_write_entry (opaque=0x25f6fa70) at block/block-backend.c:1276
acb = 0x25f6fa70
rwco = 0x25f6fa98
__PRETTY_FUNCTION__ = "blk_aio_write_entry"
#14 0x00000000101aa444 in coroutine_trampoline (i0=636902032, i1=0) at util/coroutine-ucontext.c:79
arg = {p = 0x25f65a90, i = {636902032, 0}}
self = 0x25f65a90
co = 0x25f65a90
#15 0x00003fffa0022b9c in makecontext () from /lib64/libc.so.6
No symbol table info available.
#16 0x0000000000000000 in ?? ()
No symbol table info available.
Will be attaching image_fuzzer image
|