From nobody Sun Dec 14 06:37:00 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1763341949624649.1434556430675; Sun, 16 Nov 2025 17:12:29 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vKnmP-0001HI-Oa; Sun, 16 Nov 2025 20:11:41 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vKnmL-0001Ew-F3; Sun, 16 Nov 2025 20:11:37 -0500 Received: from smtp-pop-umt-2.cecloud.com ([1.203.97.240] helo=smtp.cecloud.com) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vKnmI-0001el-RG; Sun, 16 Nov 2025 20:11:37 -0500 Received: from localhost (localhost [127.0.0.1]) by smtp.cecloud.com (Postfix) with ESMTP id 2DC46900112; Mon, 17 Nov 2025 09:11:22 +0800 (CST) Received: from localhost.localdomain (168.24.209.222.broad.cd.sc.dynamic.163data.com.cn [222.209.24.168]) by smtp.cecloud.com (postfix) whith ESMTP id P506955T281464608125296S1763341878453037_; Mon, 17 Nov 2025 09:11:22 +0800 (CST) X-MAIL-GRAY: 0 X-MAIL-DELIVERY: 1 X-SKE-CHECKED: 1 X-ANTISPAM-LEVEL: 2 X-RL-SENDER: luzhipeng@cestc.cn X-SENDER: luzhipeng@cestc.cn X-LOGIN-NAME: luzhipeng@cestc.cn X-FST-TO: qemu-block@nongnu.org X-RCPT-COUNT: 6 X-LOCAL-RCPT-COUNT: 1 X-MUTI-DOMAIN-COUNT: 0 X-SENDER-IP: 222.209.24.168 X-ATTACHMENT-NUM: 0 X-UNIQUE-TAG: <55da0fbe8708e8ede776091c18d00f92> X-System-Flag: 0 From: luzhipeng To: qemu-block@nongnu.org Cc: Alberto Garcia , Kevin Wolf , Hanna Reitz , qemu-devel@nongnu.org, luzhipeng Subject: [PATCH resend] block: add single-check guard in throttle_group_restart_queue to address race with schedule_next_request Date: Mon, 17 Nov 2025 09:10:45 +0800 Message-ID: <20251117011045.1232-1-luzhipeng@cestc.cn> X-Mailer: git-send-email 2.45.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=1.203.97.240; envelope-from=luzhipeng@cestc.cn; helo=smtp.cecloud.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1763341956034153000 Content-Type: text/plain; charset="utf-8" A race condition exists between throttle_group_restart_queue() and schedule_next_request(): when multiple ThrottleGroupMembers in the same throttle group are assigned to different IOThreads, concurrent execution can cause schedule_next_request() to re-arm a throttle timer while throttle_group_restart_queue() is being called (e.g., from a timer callback or external restart). This violates the assumption that no timer is pending upon entry to throttle_group_restart_queue(), triggering an assertion failure and causing QEMU to abort. This patch replaces the assert with a single early-return check: if the timer for the given direction is already pending, the function returns immediately. This prevents duplicate coroutine scheduling and avoids crashes under race conditions, without altering the core (non-thread-safe) throttle group logic. For details, see: https://gitlab.com/qemu-project/qemu/-/issues/3194 Signed-off-by: luzhipeng --- block/throttle-groups.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/block/throttle-groups.c b/block/throttle-groups.c index 66fdce9a90..9dcc6b4923 100644 --- a/block/throttle-groups.c +++ b/block/throttle-groups.c @@ -430,15 +430,14 @@ static void throttle_group_restart_queue(ThrottleGrou= pMember *tgm, ThrottleDirection direction) { Coroutine *co; + if (timer_pending(tgm->throttle_timers.timers[direction])) { + return; + } RestartData *rd =3D g_new0(RestartData, 1); =20 rd->tgm =3D tgm; rd->direction =3D direction; =20 - /* This function is called when a timer is fired or when - * throttle_group_restart_tgm() is called. Either way, there can - * be no timer pending on this tgm at this point */ - assert(!timer_pending(tgm->throttle_timers.timers[direction])); =20 qatomic_inc(&tgm->restart_pending); =20 --=20 2.31.1