Series comparison

-[PULL for-6.1 0/3] Block patches
+[PULL for-9.0 0/1] Block patches
-The following changes since commit 3521ade3510eb5cefb2e27a101667f25dad89935:
+The following changes since commit 786fd793b81410fb2a28914315e2f05d2ff6733b:
-  Merge remote-tracking branch 'remotes/thuth-gitlab/tags/pull-request-2021-07-29' into staging (2021-07-29 13:17:20 +0100)
+  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2024-04-03 12:52:03 +0100)
 are available in the Git repository at:
   https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to cc8eecd7f105a1dff5876adeb238a14696061a4a:
+for you to fetch changes up to bbdf9023665f409113cb07b463732861af63fb47:
-  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver (2021-07-29 17:17:34 +0100)
+  block/virtio-blk: Fix memory leak from virtio_blk_zone_report (2024-04-04 09:29:42 -0400)
 ----------------------------------------------------------------
 Pull request
-The main fix here is for io_uring. Spurious -EAGAIN errors can happen and the
+Fix a memory leak in virtio-blk zone report emulation code when the request is
-request needs to be resubmitted.
+invalid.
 The MAINTAINERS changes carry no risk and we might as well include them in QEMU
 .1.
 ----------------------------------------------------------------
-Fabian Ebner (1):
+Zheyu Ma (1):
-  block/io_uring: resubmit when result is -EAGAIN
+  block/virtio-blk: Fix memory leak from virtio_blk_zone_report
-Philippe Mathieu-Daudé (1):
+ hw/block/virtio-blk.c | 3 ++-
-  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver
+file changed, 2 insertions(+), 1 deletion(-)
 Stefano Garzarella (1):
   MAINTAINERS: add Stefano Garzarella as io_uring reviewer
  MAINTAINERS      |  2 ++
  block/io_uring.c | 16 +++++++++++++++-
 files changed, 17 insertions(+), 1 deletion(-)
 --
-.31.1
+.44.0

-[PULL for-6.1 1/3] MAINTAINERS: add Stefano Garzarella as io_uring reviewer
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-I've been working with io_uring for a while so I'd like to help
-with reviews.
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-Id: <20210728131515.131045-1-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- MAINTAINERS | 1 +
-file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ Linux io_uring
- M: Aarushi Mehta <mehta.aaru20@gmail.com>
- M: Julia Suvorova <jusual@redhat.com>
- M: Stefan Hajnoczi <stefanha@redhat.com>
-+R: Stefano Garzarella <sgarzare@redhat.com>
- L: qemu-block@nongnu.org
- S: Maintained
- F: block/io_uring.c
---
-.31.1

-[PULL for-6.1 2/3] block/io_uring: resubmit when result is -EAGAIN
+Deleted patch
-From: Fabian Ebner <f.ebner@proxmox.com>
-Linux SCSI can throw spurious -EAGAIN in some corner cases in its
-completion path, which will end up being the result in the completed
-io_uring request.
-Resubmitting such requests should allow block jobs to complete, even
-if such spurious errors are encountered.
-Co-authored-by: Stefan Hajnoczi <stefanha@gmail.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
-Message-id: 20210729091029.65369-1-f.ebner@proxmox.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/io_uring.c | 16 +++++++++++++++-
-file changed, 15 insertions(+), 1 deletion(-)
-diff --git a/block/io_uring.c b/block/io_uring.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io_uring.c
-+++ b/block/io_uring.c
-@@ -XXX,XX +XXX,XX @@ static void luring_process_completions(LuringState *s)
-         total_bytes = ret + luringcb->total_read;
-         if (ret < 0) {
--            if (ret == -EINTR) {
-+            /*
-+             * Only writev/readv/fsync requests on regular files or host block
-+             * devices are submitted. Therefore -EAGAIN is not expected but it's
-+             * known to happen sometimes with Linux SCSI. Submit again and hope
-+             * the request completes successfully.
-+             *
-+             * For more information, see:
-+             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
-+             *
-+             * If the code is changed to submit other types of requests in the
-+             * future, then this workaround may need to be extended to deal with
-+             * genuine -EAGAIN results that should not be resubmitted
-+             * immediately.
-+             */
-+            if (ret == -EINTR || ret == -EAGAIN) {
-                 luring_resubmit(s, luringcb);
-                 continue;
-             }
---
-.31.1

-[PULL for-6.1 3/3] MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver
+[PULL for-9.0 1/1] block/virtio-blk: Fix memory leak from virtio_blk_zone_report
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Zheyu Ma <zheyuma97@gmail.com>
-I'm interested in following the activity around the NVMe bdrv.
+This modification ensures that in scenarios where the buffer size is
 insufficient for a zone report, the function will now properly set an
 error status and proceed to a cleanup label, instead of merely
 returning.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+The following ASAN log reveals it:
-Message-id: 20210728183340.2018313-1-philmd@redhat.com
 ==1767400==ERROR: LeakSanitizer: detected memory leaks
 Direct leak of 312 byte(s) in 1 object(s) allocated from:
     #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
     #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
     #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
     #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
     #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
     #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
     #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5
 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
 Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- MAINTAINERS | 1 +
+ hw/block/virtio-blk.c | 3 ++-
-file changed, 1 insertion(+)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/block/virtio-blk.c
-+++ b/MAINTAINERS
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ F: block/null.c
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
- NVMe Block Driver
+             sizeof(struct virtio_blk_zone_report) +
- M: Stefan Hajnoczi <stefanha@redhat.com>
+             sizeof(struct virtio_blk_zone_descriptor)) {
- R: Fam Zheng <fam@euphon.net>
+         virtio_error(vdev, "in buffer too small for zone report");
-+R: Philippe Mathieu-Daudé <philmd@redhat.com>
+-        return;
- L: qemu-block@nongnu.org
++        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
- S: Supported
++        goto out;
- F: block/nvme*
+     }
      /* start byte offset of the zone report */
 --
-.31.1
+.44.0

The following changes since commit 3521ade3510eb5cefb2e27a101667f25dad89935:

Merge remote-tracking branch 'remotes/thuth-gitlab/tags/pull-request-2021-07-29' into staging (2021-07-29 13:17:20 +0100)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to cc8eecd7f105a1dff5876adeb238a14696061a4a:

MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver (2021-07-29 17:17:34 +0100)

----------------------------------------------------------------
Pull request

The main fix here is for io_uring. Spurious -EAGAIN errors can happen and the
request needs to be resubmitted.

The MAINTAINERS changes carry no risk and we might as well include them in QEMU
6.1.

----------------------------------------------------------------

Fabian Ebner (1):
  block/io_uring: resubmit when result is -EAGAIN

Philippe Mathieu-Daudé (1):
  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver

Stefano Garzarella (1):
  MAINTAINERS: add Stefano Garzarella as io_uring reviewer

MAINTAINERS      |  2 ++
 block/io_uring.c | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

-- 
2.31.1

From: Fabian Ebner <f.ebner@proxmox.com>

Linux SCSI can throw spurious -EAGAIN in some corner cases in its
completion path, which will end up being the result in the completed
io_uring request.

Resubmitting such requests should allow block jobs to complete, even
if such spurious errors are encountered.

Co-authored-by: Stefan Hajnoczi <stefanha@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
Message-id: 20210729091029.65369-1-f.ebner@proxmox.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io_uring.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/block/io_uring.c b/block/io_uring.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io_uring.c
+++ b/block/io_uring.c
@@ -XXX,XX +XXX,XX @@ static void luring_process_completions(LuringState *s)
         total_bytes = ret + luringcb->total_read;
 
         if (ret < 0) {
-            if (ret == -EINTR) {
+            /*
+             * Only writev/readv/fsync requests on regular files or host block
+             * devices are submitted. Therefore -EAGAIN is not expected but it's
+             * known to happen sometimes with Linux SCSI. Submit again and hope
+             * the request completes successfully.
+             *
+             * For more information, see:
+             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
+             *
+             * If the code is changed to submit other types of requests in the
+             * future, then this workaround may need to be extended to deal with
+             * genuine -EAGAIN results that should not be resubmitted
+             * immediately.
+             */
+            if (ret == -EINTR || ret == -EAGAIN) {
                 luring_resubmit(s, luringcb);
                 continue;
             }
-- 
2.31.1

From: Zheyu Ma <zheyuma97@gmail.com>

This modification ensures that in scenarios where the buffer size is
insufficient for a zone report, the function will now properly set an
error status and proceed to a cleanup label, instead of merely
returning.

The following ASAN log reveals it:

==1767400==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 312 byte(s) in 1 object(s) allocated from:
    #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
    #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
    #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
    #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
    #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
    #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
             sizeof(struct virtio_blk_zone_report) +
             sizeof(struct virtio_blk_zone_descriptor)) {
         virtio_error(vdev, "in buffer too small for zone report");
-        return;
+        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
+        goto out;
     }
 
     /* start byte offset of the zone report */
-- 
2.44.0