Since there is no else after nvme_dsm_cb invocation, metadata associated
with non-zero block range is currently zeroed. Also this behaviour leads
to segfault since we schedule iocb->bh two times. First when entering
nvme_dsm_cb with iocb->idx == iocb->nr and second on call stack unwinding
by calling blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback
because of missing else statement.

Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
---
 hw/nvme/ctrl.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 03760ddeae..7ebd2aa326 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -2372,11 +2372,12 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
         }
 
         nvme_dsm_cb(iocb, 0);
+    } else {
+        iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
+                                            nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
+                                            nvme_dsm_cb, iocb);
     }
 
-    iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
-                                        nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
-                                        nvme_dsm_cb, iocb);
     return;
 
 done:
-- 
2.35.1

On Fri, Apr 15, 2022 at 10:27:21PM +0300, Dmitry Tikhov wrote:
> Since there is no else after nvme_dsm_cb invocation, metadata associated
> with non-zero block range is currently zeroed. Also this behaviour leads
> to segfault since we schedule iocb->bh two times. First when entering
> nvme_dsm_cb with iocb->idx == iocb->nr and second on call stack unwinding
> by calling blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback
> because of missing else statement.
> 
> Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
> ---
>  hw/nvme/ctrl.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> index 03760ddeae..7ebd2aa326 100644
> --- a/hw/nvme/ctrl.c
> +++ b/hw/nvme/ctrl.c
> @@ -2372,11 +2372,12 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
>          }
>  
>          nvme_dsm_cb(iocb, 0);
> +    } else {
> +        iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
> +                                            nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
> +                                            nvme_dsm_cb, iocb);
>      }

Instead of the 'else', just insert an early 'return;' after nvme_dsm_cb() like
the earlier condition above here. Otherwise, looks good, and thanks for the
fix.

On Apr 15 13:35, Keith Busch wrote:
> On Fri, Apr 15, 2022 at 10:27:21PM +0300, Dmitry Tikhov wrote:
> > Since there is no else after nvme_dsm_cb invocation, metadata associated
> > with non-zero block range is currently zeroed. Also this behaviour leads
> > to segfault since we schedule iocb->bh two times. First when entering
> > nvme_dsm_cb with iocb->idx == iocb->nr and second on call stack unwinding
> > by calling blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback
> > because of missing else statement.
> > 
> > Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
> > ---
> >  hw/nvme/ctrl.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> > index 03760ddeae..7ebd2aa326 100644
> > --- a/hw/nvme/ctrl.c
> > +++ b/hw/nvme/ctrl.c
> > @@ -2372,11 +2372,12 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
> >          }
> >  
> >          nvme_dsm_cb(iocb, 0);
> > +    } else {
> > +        iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
> > +                                            nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
> > +                                            nvme_dsm_cb, iocb);
> >      }
> 
> Instead of the 'else', just insert an early 'return;' after nvme_dsm_cb() like
> the earlier condition above here. Otherwise, looks good, and thanks for the
> fix.

Dmitry,

Agree with Keith - also, please add

  Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")

Thanks again!

On Fri, Apr 15, 2022 at 21:42:05, Klaus Jensen wrote:
> On Apr 15 13:35, Keith Busch wrote:
> > On Fri, Apr 15, 2022 at 10:27:21PM +0300, Dmitry Tikhov wrote:
> > > Since there is no else after nvme_dsm_cb invocation, metadata associated
> > > with non-zero block range is currently zeroed. Also this behaviour leads
> > > to segfault since we schedule iocb->bh two times. First when entering
> > > nvme_dsm_cb with iocb->idx == iocb->nr and second on call stack unwinding
> > > by calling blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback
> > > because of missing else statement.
> > > 
> > > Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
> > > ---
> > >  hw/nvme/ctrl.c | 7 ++++---
> > >  1 file changed, 4 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> > > index 03760ddeae..7ebd2aa326 100644
> > > --- a/hw/nvme/ctrl.c
> > > +++ b/hw/nvme/ctrl.c
> > > @@ -2372,11 +2372,12 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
> > >          }
> > >  
> > >          nvme_dsm_cb(iocb, 0);
> > > +    } else {
> > > +        iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
> > > +                                            nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
> > > +                                            nvme_dsm_cb, iocb);
> > >      }
> > 
> > Instead of the 'else', just insert an early 'return;' after nvme_dsm_cb() like
> > the earlier condition above here. Otherwise, looks good, and thanks for the
> > fix.
> 
> Dmitry,
> 
> Agree with Keith - also, please add
> 
>   Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")
> 
> Thanks again!

Ok, will do. Can i change patch subject text or it should stay
the same between submissions?

On Apr 15 23:23, Dmitry Tikhov wrote:
> On Fri, Apr 15, 2022 at 21:42:05, Klaus Jensen wrote:
> > On Apr 15 13:35, Keith Busch wrote:
> > > On Fri, Apr 15, 2022 at 10:27:21PM +0300, Dmitry Tikhov wrote:
> > > > Since there is no else after nvme_dsm_cb invocation, metadata associated
> > > > with non-zero block range is currently zeroed. Also this behaviour leads
> > > > to segfault since we schedule iocb->bh two times. First when entering
> > > > nvme_dsm_cb with iocb->idx == iocb->nr and second on call stack unwinding
> > > > by calling blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback
> > > > because of missing else statement.
> > > > 
> > > > Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
> > > > ---
> > > >  hw/nvme/ctrl.c | 7 ++++---
> > > >  1 file changed, 4 insertions(+), 3 deletions(-)
> > > > 
> > > > diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> > > > index 03760ddeae..7ebd2aa326 100644
> > > > --- a/hw/nvme/ctrl.c
> > > > +++ b/hw/nvme/ctrl.c
> > > > @@ -2372,11 +2372,12 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
> > > >          }
> > > >  
> > > >          nvme_dsm_cb(iocb, 0);
> > > > +    } else {
> > > > +        iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
> > > > +                                            nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
> > > > +                                            nvme_dsm_cb, iocb);
> > > >      }
> > > 
> > > Instead of the 'else', just insert an early 'return;' after nvme_dsm_cb() like
> > > the earlier condition above here. Otherwise, looks good, and thanks for the
> > > fix.
> > 
> > Dmitry,
> > 
> > Agree with Keith - also, please add
> > 
> >   Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")
> > 
> > Thanks again!
> 
> Ok, will do. Can i change patch subject text or it should stay
> the same between submissions?

Changing it is ok :)