On Tue, Oct 11, 2011 at 04:22:11PM +0200, Kevin Wolf wrote: > Am 30.09.2011 17:49, schrieb Amit Shah: > > On (Fri) 30 Sep 2011 [16:23:30], Stefan Hajnoczi wrote: > >> On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah <amit.s...@redhat.com> wrote: > >>> On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote: > >>>> QED's metadata caching strategy allows two parallel requests to race for > >>>> metadata lookup. The first one to complete will populate the metadata > >>>> cache and the second one will drop the data it just read in favor of the > >>>> cached data. > >>>> > >>>> There is a use-after-free in qed_read_l2_table_cb() and > >>>> qed_commit_l2_update() where l2_table->offset was used after the > >>>> l2_table may have been freed due to a metadata lookup race. Fix this by > >>>> keeping the l2_offset in a local variable and not reaching into the > >>>> possibly freed l2_table. > >>>> > >>>> Reported-by: Amit Shah <amit.s...@redhat.com> > >>>> Signed-off-by: Stefan Hajnoczi <stefa...@linux.vnet.ibm.com> > >>>> --- > >>>> Hi Amit, > >>>> Thanks for reporting the assertion failure you saw at > >>>> http://fpaste.org/CDuv/. > >>>> Does this patch fix the problem? > >>> > >>> Yes, this fixes it. > >> > >> Were you able to reliably reproduce the assertion failure before? > > > > Absolutely. > > > > I even reverted the patch and tried the same image; same segfault > > again. > > > >> I wonder because this only happens when two metadata lookups race > >> (which is rare enough on my setup that I've never seen this failure). > >> It might be worth trying a few times. > > > > Get the F16 beta-rc LXE live iso, install guest. It doesn't cleanly > > reboot, you have to kill the VM. Next start of the VM produces this > > segfault. > > > > https://alt.fedoraproject.org/pub/alt/stage/16-Beta.RC2/Live/x86_64/Fedora-16-Beta-x86_64-Live-LXDE.iso > > Can we try to artificially produce it in a qemu-iotests case?
I will take a look. Stefan