diff options
| author | Emanuele Giuseppe Esposito <eesposit@redhat.com> | 2023-02-09 10:45:22 -0500 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2023-02-17 14:33:58 +0100 |
| commit | 005ee3cdc79e05b7691c8ce078c147c1f9336814 (patch) | |
| tree | 59fbdb5b354c35d3b832b348e47aa885f849d4b3 /block | |
| parent | 167643ff5e77bdfa3d2867f2e2469741484bd63f (diff) | |
| download | qemu-005ee3cdc79e05b7691c8ce078c147c1f9336814.zip qemu-005ee3cdc79e05b7691c8ce078c147c1f9336814.tar.gz qemu-005ee3cdc79e05b7691c8ce078c147c1f9336814.tar.bz2 | |
block/file-posix: don't use functions calling AIO_WAIT_WHILE in worker threads
When calling bdrv_getlength() in handle_aiocb_write_zeroes(), the
function creates a new coroutine and then waits that it finishes using
AIO_WAIT_WHILE.
The problem is that this function could also run in a worker thread,
that has a different AioContext from main loop and iothreads, therefore
in AIO_WAIT_WHILE we will have in_aio_context_home_thread(ctx) == false
and therefore
assert(qemu_get_current_aio_context() == qemu_get_aio_context());
in the else branch will fail, crashing QEMU.
Aside from that, bdrv_getlength() is wrong also conceptually, because
it reads the BDS graph from another thread and is not protected by
any lock.
Replace it with raw_co_getlength, that doesn't create a coroutine and
doesn't read the BDS graph.
Reported-by: Ninad Palsule <ninad@linux.vnet.ibm.com>
Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Message-Id: <20230209154522.1164401-1-eesposit@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/file-posix.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/block/file-posix.c b/block/file-posix.c index d3073a7..9a99111 100644 --- a/block/file-posix.c +++ b/block/file-posix.c @@ -1738,7 +1738,7 @@ static int handle_aiocb_write_zeroes(void *opaque) #ifdef CONFIG_FALLOCATE /* Last resort: we are trying to extend the file with zeroed data. This * can be done via fallocate(fd, 0) */ - len = bdrv_getlength(aiocb->bs); + len = raw_co_getlength(aiocb->bs); if (s->has_fallocate && len >= 0 && aiocb->aio_offset >= len) { int ret = do_fallocate(s->fd, 0, aiocb->aio_offset, aiocb->aio_nbytes); if (ret == 0 || ret != -ENOTSUP) { |