From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020103.outbound.protection.outlook.com [52.101.84.103]) by lore.virtuozzo.com (Postfix) with ESMTPS id 6749F80D23 for ; Mon, 26 Oct 2026 17:49:39 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HaKm3+tcTkbJFzemVEQNACfE53nlcEbhR+x5nGuCOnRbNBQo0ySV2ihcqdyfsMKAtlQ1zq1NSDc1lhWKgyIp3tC01knmCQwNVviIBWLYASemGJdsbs2dUbIhscYfstLKuVf7+VsE/zCoQDVT7TMSOmYGJOGGe/hCt3/hVf96RVvrOxGVUOtJFngZaacgV6rw/fA97anP9gzaLtt92RGQQrupeZySJvmU7fXSZWaHv/WMOlmQNOW6Vqm/lRgL1njP1HJLwPzVi1FF1F4b8WUaMTmMjdopWI/PVDQLy01Mg3DWic9KIy+8Rl4LWNkqgMVAAKW7rQk3hu53rSR5EjzPIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aSwrgiw0fSyJ7hOn3ICIbnha+nHCg4o3KFOphljHA8I=; b=pa62pcET7EPWUOKG/MJpCaJokvc0TWwXU3wlHWoGz0kvgLHWlnx4odZYPpKb/h4Ibd9wvugGH1UwEvGEfKev+AH6jjKAbXm59WaNDoGbTv8OiG7AZ5ots4RiLKUCV/g3OtybnEEaOFSlmZpM8ICRs+U4UFUummWF+io3vwhWWDeQ6yJQyWRibVU4S5FWbWBqSEW7ySHjhkiVuNG5M6mg+s5XWfTSQi8JD+ONmKSpYKCLZ+9FL5PiaswdwgIW9SV7fQpNLuOD1RZEWP3u52erM9eu1S41354Xd9Vtw/qZ0Gbr9cFIWqdoqv0CKMiUdifOZbOvL/+W2Ce/AybvyONi/A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::333) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aSwrgiw0fSyJ7hOn3ICIbnha+nHCg4o3KFOphljHA8I=; b=cbpfSuNBQvaoBoLbeZeLG+cD0MWG336mfOQe4F7sI+0Rpt7e1+s7YrnnV4pVnosByttRIRKjnMhq4uORlymVg/qKoQcJaOz+oPF/Nge7YxaDcbdsnUBeYJP4uafRcJtFP8xT+U34/4bRUK8Dvm1yH9vzKEVvIPnb6n2BV9y0P+4= Received: from AS8P251CA0007.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:2f2::7) by DU0PR08MB9533.eurprd08.prod.outlook.com (2603:10a6:10:44f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 17:49:35 +0000 Received: from AMS1EPF0000009E.eurprd02.prod.outlook.com (2603:10a6:20b:2f2:cafe::8d) by AS8P251CA0007.outlook.office365.com (2603:10a6:20b:2f2::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 17:49:35 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 2a00:1450:4864:20::333) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::333 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::333; helo=mail-wm1-x333.google.com; pr=C Received: from mail-wm1-x333.google.com (2a00:1450:4864:20::333) by AMS1EPF0000009E.mail.protection.outlook.com (2603:10a6:20f:fff8::20b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 17:49:34 +0000 Received: by mail-wm1-x333.google.com with SMTP id 5b1f17b1804b1-4a140e7405dso33318095e9.3 for ; Mon, 26 Oct 2026 10:49:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793036974; x=1793641774; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aSwrgiw0fSyJ7hOn3ICIbnha+nHCg4o3KFOphljHA8I=; b=ki6rcj7e5vK9hIXL/Jb2zos6+hFCzPlIwv/4kpgBv47vbOKjEWcesRzmHkcfqpxkCo NGwCfyUQIz38qFMqJrbk+vLkgc2RiDnT7cVxQIP6h1yrD5iyOhEn1hsIY2okgwY8R510 PG2DhFUtA8Ptxv0jD5oMN1Ehq+CJuqvnjE8junYTVBEj1zwgCk24sLly/422daUgl+Zi WQqEA7dX2ESMp6NT54jTEk5WNJkst3qoPAnYIL/PL6nAjZzCOH3pJW9H8opqtSRN6Csu n+OUfiuNl7vB1/YdjcJvs+afuEQQMCZYFOHnxeFQJZqk8wyT8HZZqSqDhDvygOJS/6gr 7VEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793036974; x=1793641774; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aSwrgiw0fSyJ7hOn3ICIbnha+nHCg4o3KFOphljHA8I=; b=k4QHmGh/2tuaxo/uRAqQ8WwXkf024E8lE5PCDzEVSg60s1+ylm5vv6YeAfXvRsUEFG swRp0tzKyb4kp2tIFpJtSXv7CF2bjoAshBlXsoH+1ubVt04GEietZnz3IRXwAe7DyKQr Sus/UCG2jUty2Hw5GLuzDSwRt4PGgeD6VGaElfOiJ6TRHDDLBtAdvZ3v5j2xfWcsomHn UMvwOQebt6AD4m2a9W88uXblq1InliYVXagVAwz7mgb4wdUV7Y7zjxhPBUHeanQCEW1e 9zGElZj+csAAsgoFp8o14RYjn9wBZqY5Rfocp46Det1w0YD2CLzC7j2ttls6d58DXb2z 1nfA== X-Gm-Message-State: AFq9FYJXXh2ImVx2H6JzifoJcKwshjr0TCVNGVRBv1y7zFkHg+yKvqJh gmvJhUsQUozg7Y29glU7WvDPAQf3uddSaLlYMNdshR0esO4i2qmNjNrAYh4dQpmPG90SLA== X-Gm-Gg: AYBFou3GCJW3aBb9N5PG5GFDfCXtsq3TfTFi7T7/GTUdOCFpusg5b7jrEbDSqxRA0Qo d9LVQCeJU2YEh4I9SDK5eQ7rsczRH37+H6vGtgOiCeY3J1D3tnYh3yfKzbNDKiG/Nl9M4iZL3QF XwfH8SlAGf1gA1U9d/FUiPQIk3Mo/3bepg8gTHsXgwVxB2Ct1WKpW5BRGHnlWTVUCUSnFDSEXMw POtqCNRa/KX5p/kEdV6EBnN/LzhXyTe68/D7qx5ER8k0/AKTtuqrGcXvMz+FBlT1Ciqhl/4jsFP 2+5Xz2CErnbeIQCv7gKuJsAWWczEXlQDa43u2DwbXnFGBhGwosk2ipjutz0fldWk0JJ04CoZmBf 3sMkIGBzRoYv3naSow4wK6QHYS8uh5NThEvsWXkSn9Ks2HRcb0l5QXPouEOuZZb0ZRwUApwveGt o0uqDllfGJELwbTZ2IMU8SGn80XmdD16xWPZR60lAzmbl6xK5nGv4GLzqUs7Rhf93FU5w3vKA8O 35kQOHnd+Lm1q2Xfm6Lc4ab4G2kUO+xpe7Cc5svx3rz8BX2ouB8 X-Received: by 2002:a05:600c:840e:b0:4a2:b89:b02 with SMTP id 5b1f17b1804b1-4a35acafc84mr131494685e9.10.1793036974151; Mon, 26 Oct 2026 10:49:34 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a574088sm196211485e9.9.2026.10.26.10.49.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 10:49:33 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 3/5] scsi-disk: fix WRITE SAME racing with inactivation of block nodes #VSTOR-151532 Date: Mon, 26 Oct 2026 18:49:27 +0100 Message-ID: <20261026174929.685720-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026174929.685720-1-den@openvz.org> References: <20261026174929.685720-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS1EPF0000009E:EE_|DU0PR08MB9533:EE_ X-MS-Office365-Filtering-Correlation-Id: 5374e01b-e8ac-4cc7-1dff-08df33897f39 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|6059299003|61400799027|376014|82310400026|43022699015|9140799003|48200799018|10067099003|261026121527099003|261021133027099003|261021123027099003|261021135927099003|261021121427099003|261022113327099003|261022115727099003|261021130227099003|261022105027099003|261022075727099003|261009223027099003|5063699009|261026135527099003|56012099006|18002099003|22082099003|16102099003|261026140227099003|55112099003|261026130827099003; X-Microsoft-Antispam-Message-Info: FC0uSfLAlJGCFUpoh2KpjNx/b5ppAxi8lyzp5o6ZVOZo+67j5lGoF+98ZQxjftc0qepMWFWLXA5LL9CpNbiMrySwNfNIjpViOd5qXQggMCAQx+Y2flJOlkwJGnXBn+L23OmRBbTTghh+PAofQVv/2oChD2j5QpNfXisxoGxE8I0318I+7myUVm7/MtzGKEeQ4x51wgz6CyUK/ODdV7R3WX2LyGxq+eq5VzDIPEKCkPlMJasYu8mKoJX4IT+ply4PpmgDO9QGHFaZ5+omb9sB/CeSplv1Tj7/bfWy7uvWICy6A3TAGg1sr06bUHp1IVYuun5ZvEAuDogh0Z4EGZ+bcBKx072IMjpSQg9MSGt9xVpw282quMwvyLTkmlicC+0RdLmFwgMQ/Hik1N0FP2MFC11HRgj/zf6hllTQTwCkDIdztWiUboRAR3kMR17HvLsBVbe2xEToesxAIkIqaY/+2j6RnsfUJdYC2u2L0a+C7eY5lOM7e3XFMDGIM2MAXyxxzPNblFm7ldF9QnpvsU7iRlTrQt1GfKaz52A70n0oeVYFvE9bAjQX39JUk9618ESWTucxCVeMaK6FmhLVDe0Y5GrH0PZkyUa7CS8nw73jYN3UnVLrpyEIopqaA0hmyEtcC/14Sx1Rq+obwXN0e1PStGgM8K+Mi5EgDJFuMhmTHqY8X/4dZilo9ctYSR1HO4pAFPySd52GRfSwKZXQTeZHhK2HRUHE9LlKWBU5llUpMduQnOgtFqseEUhQTpSWdOPE+uHif2s1eQtBn120PS5FxUfWfSGbN40VqFDfgG9g01wM9tpgkENJlc7biZJpVCHbp41U9ev9SpJMMU9aJz6F0angeV3d9ab5iAp1FF8bd/d7W6tnRL/mrJBKGqMCiAod2tRwyU2KRp9seo3nSBmBneI7TLtmZ5+Umci56ZrKPGTAuoqql9oiYos1Ex+OII8M X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::333;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x333.google.com;PTR:mail-wm1-x333.google.com;CAT:NONE;SFS:(13230040)(6059299003)(61400799027)(376014)(82310400026)(43022699015)(9140799003)(48200799018)(10067099003)(261026121527099003)(261021133027099003)(261021123027099003)(261021135927099003)(261021121427099003)(261022113327099003)(261022115727099003)(261021130227099003)(261022105027099003)(261022075727099003)(261009223027099003)(5063699009)(261026135527099003)(56012099006)(18002099003)(22082099003)(16102099003)(261026140227099003)(55112099003)(261026130827099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: DkmU3zJCPbaoUHbgx0WgD4GZEJCHXe8wkPINNkb3LPzm7U3TC8BHinY3YjRWoCuN5Rf5OXE7/C+j9u6bhD89wBXB/jEw/XNPv13AIg40EgxBILOHZda2pVCUqISeVwVExZe39jLq0xTCBG5JG0EgizMuvRWeaFVYT3Px/DB4T6scUrQVP9UMPkIZK3PYxlGFxmNb57VL7MiJjwhL2bMLZ85OJtl/cWAh6/j03ZaYV0fdVg2kP+QRAlYgsHImD1W/OnhtHZ8UIdcLJoOedTmTtynhKQia+7ETi/6I8xvVryvkwFFD/YzdGkv7HIgKV8kAzgfwR6YCs3Xl1XTLMO7h5j82cXHMzNeUsy+9qECtb6TATvRfJr441LhliubRcfYuj3yTdNs0TNJibce+RZMlAy9xExd9jBLWBsyvO3wjTLwx+36+Xd/wQ7oO5ITNgZ60 X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 17:49:34.7345 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5374e01b-e8ac-4cc7-1dff-08df33897f39 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AMS1EPF0000009E.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB9533 List-Id: From: Denis V. Lunev WRITE SAME with a non-zero pattern is written in SCSI_WRITE_SAME_MAX chunks, and each chunk is submitted from the completion callback of the previous one. As with UNMAP, a drain only waits for the chunk in flight, the next one is queued by blk_wait_while_drained(), and bdrv_inactivate_all() resumes it on an inactive node: bdrv_co_write_req_prepare: Assertion `!(bs->open_flags & BDRV_O_INACTIVE)' failed. Write the chunks from scsi_disk_co_aio_start() with BDRV_REQ_NO_QUEUE, so a drain waits for the whole command. werror=ignore still goes on with the next chunk. The sector count becomes int64_t on the way: the old int overflowed for a WRITE SAME(16) of 2^31 or more 512-byte sectors. Signed-off-by: Denis V. Lunev Cc: Paolo Bonzini Cc: Kevin Wolf Cc: Hanna Reitz Cc: qemu-stable@nongnu.org --- hw/scsi/scsi-disk.c | 102 +++++++++++++++++--------------------------- 1 file changed, 39 insertions(+), 63 deletions(-) diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index 8383b7cbe93..f287315fbc5 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -1929,52 +1929,52 @@ invalid_field: scsi_check_condition(r, SENSE_CODE(INVALID_FIELD)); } -typedef struct WriteSameCBData { - SCSIDiskReq *r; - int64_t sector; - int nb_sectors; - QEMUIOVector qiov; - struct iovec iov; -} WriteSameCBData; - -static void scsi_write_same_complete(void *opaque, int ret) +static int coroutine_fn scsi_write_same_co(SCSIDiskCoAIOCB *iocb) { - WriteSameCBData *data = opaque; - SCSIDiskReq *r = data->r; + SCSIDiskReq *r = iocb->r; SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev); + BlockBackend *blk = s->qdev.conf.blk; + uint8_t *inbuf = r->iov.iov_base; + uint32_t buflen = MIN(s->qdev.blocksize, r->buflen); + int64_t sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE); + int64_t nb_sectors = (int64_t)scsi_data_cdb_xfer(r->req.cmd.buf) * + (s->qdev.blocksize / BDRV_SECTOR_SIZE); + size_t size = MIN(nb_sectors * BDRV_SECTOR_SIZE, SCSI_WRITE_SAME_MAX); + uint8_t *buf = blk_blockalign(blk, size); + int ret = 0; + size_t i, l; + + for (i = 0; i < size; i += l) { + l = MIN(buflen, size - i); + memcpy(&buf[i], inbuf, l); + } - assert(r->req.aiocb != NULL); - r->req.aiocb = NULL; + while (nb_sectors > 0) { + size_t chunk = MIN(nb_sectors * BDRV_SECTOR_SIZE, size); - if (scsi_disk_req_check_error(r, ret, true)) { - goto done; - } + if (iocb->canceled) { + ret = -ECANCELED; + break; + } - block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct); + block_acct_start(blk_get_stats(blk), &r->acct, chunk, + BLOCK_ACCT_WRITE); + ret = blk_co_pwrite(blk, sector << BDRV_SECTOR_BITS, chunk, buf, + BDRV_REQ_NO_QUEUE); + if (ret < 0) { + if (!scsi_disk_ignore_error(r, ret)) { + break; + } + ret = 0; + } + block_acct_done(blk_get_stats(blk), &r->acct); - data->nb_sectors -= data->iov.iov_len / BDRV_SECTOR_SIZE; - data->sector += data->iov.iov_len / BDRV_SECTOR_SIZE; - data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE, - data->iov.iov_len); - if (data->iov.iov_len) { - block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, - data->iov.iov_len, BLOCK_ACCT_WRITE); - /* Reinitialize qiov, to handle unaligned WRITE SAME request - * where final qiov may need smaller size */ - qemu_iovec_init_external(&data->qiov, &data->iov, 1); - r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk, - data->sector << BDRV_SECTOR_BITS, - &data->qiov, 0, - scsi_write_same_complete, data); - return; + sector += chunk / BDRV_SECTOR_SIZE; + nb_sectors -= chunk / BDRV_SECTOR_SIZE; } - scsi_req_complete(&r->req, GOOD); - -done: - scsi_req_unref(&r->req); - qemu_vfree(data->iov.iov_base); - g_free(data); + qemu_vfree(buf); + return ret; } static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) @@ -1983,9 +1983,6 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf); uint32_t buflen = MIN(s->qdev.blocksize, r->buflen); - WriteSameCBData *data; - uint8_t *buf; - int i, l; /* Fail if PBDATA=1 or LBDATA=1 or ANCHOR=1. */ if (nb_sectors == 0 || (req->cmd.buf[1] & 0x16)) { @@ -2017,28 +2014,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) return; } - data = g_new0(WriteSameCBData, 1); - data->r = r; - data->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE); - data->nb_sectors = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE); - data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE, - SCSI_WRITE_SAME_MAX); - data->iov.iov_base = buf = blk_blockalign(s->qdev.conf.blk, - data->iov.iov_len); - qemu_iovec_init_external(&data->qiov, &data->iov, 1); - - for (i = 0; i < data->iov.iov_len; i += l) { - l = MIN(buflen, data->iov.iov_len - i); - memcpy(&buf[i], inbuf, l); - } - - scsi_req_ref(&r->req); - block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, - data->iov.iov_len, BLOCK_ACCT_WRITE); - r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk, - data->sector << BDRV_SECTOR_BITS, - &data->qiov, 0, - scsi_write_same_complete, data); + scsi_disk_co_aio_start(r, scsi_write_same_co); } static void scsi_disk_emulate_write_data(SCSIRequest *req) -- 2.53.0