From nobody Sat Jul 25 06:37:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784891651; cv=none; d=zohomail.com; s=zohoarc; b=kY6FyOA1wnUJqUKWjL79zj1URbBLAm2Zk03gHSI3pHOH6y0siwgFJYxj4pwu3poR/+9H6nPc0f7jFxo1UHjLQO/fjmryZ48h0kKeTIqBPletjTRcFqHQOpfZn2uNLaSGHnBdZJFiJbbwU7Yuuu3opVbCWwyHGVaos9vsvrHRhmI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784891651; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QSz9ULdBhCoTeM0qoNiUS/2WEzeqnZtRmE889KhJ2pc=; b=FmY+YFxzreZurGa82VoNW4T1ASZh2flF+mDGY25qR9oMLR7hEh79J/0KqHMsUmPsfwJ/NruXNJhznVH0ElL/Kkx6qDuGLd3KU14J3IVcEULWNufxiN37oNtybH3FvVy9lDAjYFTnSj9ipuo9iemj6uIRkxlSHWKPuzLuGNNtkeM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784891651560794.1623023853792; Fri, 24 Jul 2026 04:14:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnDqD-0001Te-Hz; Fri, 24 Jul 2026 07:13:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnDqB-0001SR-JA for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:19 -0400 Received: from mail-wm1-x32c.google.com ([2a00:1450:4864:20::32c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wnDq9-0001lT-AY for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:19 -0400 Received: by mail-wm1-x32c.google.com with SMTP id 5b1f17b1804b1-49555a0e68bso1967255e9.2 for ; Fri, 24 Jul 2026 04:13:16 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:4f7d:7b60:9d07:3a1b]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c531basm23792473f8f.19.2026.07.24.04.13.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 04:13:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784891596; x=1785496396; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QSz9ULdBhCoTeM0qoNiUS/2WEzeqnZtRmE889KhJ2pc=; b=t3Bi/phtXkRmBzqX/DvIal3j6aK4res6N1QGSoLz6YoGjgLFbtzzbG4Eh7+u7s0fHU A2TZ1PNU99Q4Z40evrVkrpVfXW6BRh3Cf9EqRqcnXfRgxKreuHzeQ6t8fR8qDQJfxYji ZGZ394CsXUhf4wnDNwu2m4rz25o8PJZuEGj00zrQiVu67ruxUfFvsdXTDZjXVi/s6RCu kjayRiPnZRop3C6ilNkWk08ifCcXJGh73cl8eL4BEQ2fUibday6Vfo3aFWBtV3IrfIcA NLFDzWqBFNK0WeFnYCs424VSvUcgPMqDY7z9BG5ObIrRloAQHtedxb3BuIY0G+PEJLhZ VNRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784891596; x=1785496396; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QSz9ULdBhCoTeM0qoNiUS/2WEzeqnZtRmE889KhJ2pc=; b=bA1B8Z9qDVmQmPna0y9A/wnpr1zzp9O7ndPv9Sntiil5hnNSUStZcIzR+JF6cKJrIp mCy4pjjopQ8SlK++bDXiS9PwQHuF1yx085BR3Ozu3iCKwtH9HvCqcLulHb2Wf954x8Z2 HuD0YqVWwCaMOm+xLjuevCdRbRE2nju0nnfCfliGFotVh1kFQeKSptaqTyg70PBp+Hf8 5T9Bo72x8CRJFM3ryqbsFLrhyecvE5atceEb0klXtO6/le5Wdy+kfEOs7udWRxVMgS4w EnJHIEKmqNz5XL3VbDk+1gCGr0Bsuf+PGuTbrdyryiUhVqp5eMaa7mhAGUv+8O9fKStM anow== X-Forwarded-Encrypted: i=1; AHgh+RroQUIY6WRCpbwmv8P1b9/BPQDGhedwplhk4nRtmBYvepa/8oCMYfCjYUaLyuoVpGaIkejLlB/SILgr@nongnu.org X-Gm-Message-State: AOJu0Yzn9mJr5xuEMMoNP9CXil3fM01eOFDz5CLwItDggMWFWJ0yjdKf CNJ8WKSx2gPgWXjHlHp7l3XXnZ3DVQpi70zxVCTxfj2djEoBWA3orZKl8kBvhwnphWE= X-Gm-Gg: AR+sD13D0tTr+ZGSqDyAsO2atFC3ZN7jnnzqJVwrKbC+GJ++ZqnA5asNtGNz8Fi8Mxh R61+0xY5bN40LaiMHfV3O7A3wvFSBkTmao074Pvw62361OSwytiLkdplIoWkpoWDGKfnz8PcsKn UHxSvcl+W0esICi+Ul8zVBE6eovtz/A6GavY+zm6mBkkPcBm0iByOAbI/wDtHcEzB9DLTB3OgSB 7DDQJ45nW22BPPH/UwB6g3teVB/CaTJ1bDT5idELNv35J8iDkOFMuOQMac0rrga7IcO3IgLU2DO +nAakErdX4qqxQWvk/cbYxcCMLHxzn7f+aMI6Q0vP3CUae12LDmDrsSioeavxAdlODwbSFNdZrt oAw1uWy9dwxwStlUD7+NMo4Ha+Nb5/ITFjdYbgpAciejoFp6yy1SEYfqYpSqAg42vlN9t2f12bh I= X-Received: by 2002:a05:600c:6b6a:b0:495:3f0f:d515 with SMTP id 5b1f17b1804b1-49573cf4d25mr57614815e9.36.1784891595808; Fri, 24 Jul 2026 04:13:15 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy , Andrey Drobyshev Subject: [PATCH v2 1/3] block/accounting: take stats->lock in latency histogram setters Date: Fri, 24 Jul 2026 13:13:09 +0200 Message-ID: <20260724111311.4086859-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724111311.4086859-1-den@openvz.org> References: <20260724111311.4086859-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::32c; envelope-from=den@openvz.org; helo=mail-wm1-x32c.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784891654182158500 Content-Type: text/plain; charset="utf-8" block_latency_histogram_set() and block_latency_histograms_clear() replace BlockLatencyHistogram's nbins/boundaries/bins without taking stats->lock, while block_account_one_io() reads those same fields under that lock from whatever iothread completes the I/O. The result is usual use-after-free and qemu crash. Take stats->lock in both setters, matching the lock already held by the reader. Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy CC: Andrey Drobyshev --- block/accounting.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/block/accounting.c b/block/accounting.c index f00fe99740..6e06c7609e 100644 --- a/block/accounting.c +++ b/block/accounting.c @@ -194,6 +194,8 @@ int block_latency_histogram_set(BlockAcctStats *stats, = enum BlockAcctType type, return -EINVAL; } =20 + qemu_mutex_lock(&stats->lock); + hist->nbins =3D new_nbins; g_free(hist->boundaries); hist->boundaries =3D g_new(uint64_t, hist->nbins - 1); @@ -206,6 +208,8 @@ int block_latency_histogram_set(BlockAcctStats *stats, = enum BlockAcctType type, g_free(hist->bins); hist->bins =3D g_new0(uint64_t, hist->nbins); =20 + qemu_mutex_unlock(&stats->lock); + return 0; } =20 @@ -213,12 +217,16 @@ void block_latency_histograms_clear(BlockAcctStats *s= tats) { int i; =20 + qemu_mutex_lock(&stats->lock); + for (i =3D 0; i < BLOCK_MAX_IOTYPE; i++) { BlockLatencyHistogram *hist =3D &stats->latency_histogram[i]; g_free(hist->bins); g_free(hist->boundaries); memset(hist, 0, sizeof(*hist)); } + + qemu_mutex_unlock(&stats->lock); } =20 static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *c= ookie, --=20 2.53.0 From nobody Sat Jul 25 06:37:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784891650; cv=none; d=zohomail.com; s=zohoarc; b=a2ECsgyYIBHLAYybD1tULbOMibDtb5Fxse2vvAoqxpX6qvNRMf4TlLg9sHZG4ig/mJJjXt6XId3QIAglFank81qurJAEpcNWU6dt+EEX/8l4LilmRowfwb6tt88y6k9r7qI2IuANLeMZ2z7Uy8oTOIZcrEZiDH+bmRk0bybS3VE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784891650; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EZTUC4iHyfbtLEvtqVzHaS77nTo86Y/qr4iJdglZIkk=; b=XX9jH9seHi1aJ3Zksfzawio9FGbDAtaiq2VmvEq0uNtCpuCTGK5prHE6SYaumg7z5nWAF7vgJ4icnVZyqG6czvrlsfPmGEvzmCa3YaAaVGOxibVSNRYHHIWt3n4t4033a+FjpKqp6pdnDO86iCm7E0ZNymb1/UdVW+wthyKJv5E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784891650728162.72196451545835; Fri, 24 Jul 2026 04:14:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnDqE-0001Uz-EC; Fri, 24 Jul 2026 07:13:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnDqC-0001TK-Hp for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:20 -0400 Received: from mail-wm1-x332.google.com ([2a00:1450:4864:20::332]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wnDqA-0001lc-OG for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:20 -0400 Received: by mail-wm1-x332.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so1963285e9.2 for ; Fri, 24 Jul 2026 04:13:18 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:4f7d:7b60:9d07:3a1b]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c531basm23792473f8f.19.2026.07.24.04.13.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 04:13:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784891597; x=1785496397; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EZTUC4iHyfbtLEvtqVzHaS77nTo86Y/qr4iJdglZIkk=; b=MUqsvkn2qrf54zQ50mKGWiu+ih+s6nNfGrpWQYdYDZrvjkqlGX5Rl2m50eioAAjNl6 O+Pm4Dn8eOt9VLqgWgPB0eIUqdF5Hz+RR8aKGvMfMW9EzV2EG2/9MH9P2u0hBdPYukl3 jus4dKBINAPgcpxvnekL2qcziADk9Tv2vlLbMv/vp4L+Zm3Dbe0MvrBj2QI1Xo9qFGMI e5Nw372Xle9FvoKU7nZ2Ly/leAM2zKzcxpBrY2kquJnCb02bYqvIC7JvG4neGCpobnp9 O+X6fJqoSjBBxCV8OoXm0X1odY3WmPgjh6tepEuzawcf51kh5yYskc0UKxGCuefafdEt MvWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784891597; x=1785496397; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EZTUC4iHyfbtLEvtqVzHaS77nTo86Y/qr4iJdglZIkk=; b=rRUlazRy/0DX6qqYlq8+s6pYFg2M+pRIdTm/bbv/vWSoP+QLURpzSOdqCyivl62df4 uoO4tFbzZorspqyRkY293uga3X6YhTcUlKl2+pWLqFkEy44zp1Lvj+Nz3Xs6D1CE39TV ZI3jMMq0lNGKf6gysxJfP+U6Twbb0K+5HK7PRyBFL+Q39yMXil0j69mcE48V6N07+jgq 94TYP9OWZI9+KKttxSu8bdp/SpYXZjQBjZho0BvvX877vWEqhbtgOU4y/plDsQEzodG1 Z47IOu0bmxM9kFlnZ8ibOsPyEcomAAZdD0I3uCldRdWJEJwuIsna9gvS3G8jmz4fxujN UsIg== X-Forwarded-Encrypted: i=1; AHgh+Rqw7cTr5ZTQtX3ke3qGyHBZvy/UJZDkafcTi6jNuJ/0OzN1CyiTuIFYqgay2Kqtl7OQngexevkG4NfV@nongnu.org X-Gm-Message-State: AOJu0YwqDJxdZXeKYNaq+3yaxI/TPys+Vs5twsbI6+Hb5QZW6I6rY8oO D9rTcAEpwLvlBGMX2FFsJPJibJZ5CDx1HCd6K569pVqkHEJsUKu+qM1iZUGF5U9ciKI= X-Gm-Gg: AR+sD1219QSQcR6Rz0HDSyqZ7Q33zTN3NRgUHTTndLcY2urDHL3+ZrVY7oZpZLZlmZA UGKlB2g0irf8SJhuBP13QENjKHXtF27pMrb2HUqec0wMt6UW27tepGI9KC77Eb2ymy+2+2uBq7h 1fd9VAIg4M58Dgw4z8DPc08Qo8T18V9udpiG9i1NieZyuA6gKpEu4zw9kDP9/w2rNIhrhFSZi59 OYvrzOouJZW85ZN+UwRSYUSRshXTRHZskfTUX0u6PiBv2zRnPgiRSRxUthQmbLDSar90fBtNNJX JVs3vYdp9jPHTSCGW20n8rw21jEGMipfluWsQhSAAiMzu+km1pbG9LzBeH3FkgvcenLSu1Uerkc OExE0METh3rBQjiqGRsPRJ5vxPAEZ7cCJYzCJD/6h7B648xwBOg8AwlG9/rklDkI5dWeeOQlhFa C2+s/Siz08aw== X-Received: by 2002:a05:600d:8498:20b0:495:3de8:33a6 with SMTP id 5b1f17b1804b1-49573c9daeamr59038495e9.16.1784891597167; Fri, 24 Jul 2026 04:13:17 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy , Andrey Drobyshev Subject: [PATCH v2 2/3] block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats Date: Fri, 24 Jul 2026 13:13:10 +0200 Message-ID: <20260724111311.4086859-3-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724111311.4086859-1-den@openvz.org> References: <20260724111311.4086859-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::332; envelope-from=den@openvz.org; helo=mail-wm1-x332.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784891652366158500 Content-Type: text/plain; charset="utf-8" bdrv_query_blk_stats() reads BlockAcctStats's counters, latency histogram, and per-interval TimedAverage stats without stats->lock, while block_account_one_io() updates the same fields under that lock from an iothread. timed_average_min()/max()/avg() make this worse than a stale read: they call check_expirations(), which can reset a window's sum/count/min/max -- a write, not just a read -- so this is a genuine race with a concurrent writer, not merely a slower reader like the scalar counters. Take stats->lock for the whole call, both to close the race and to make the returned snapshot internally consistent (previously each field could reflect a different instant relative to concurrent updates). block_acct_queue_depth() used to take the lock itself on every call; since bdrv_query_blk_stats() is its only caller and now already holds the lock, that would self-deadlock. Make it require the caller to hold stats->lock instead (documented and asserted). Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy CC: Andrey Drobyshev --- block/accounting.c | 3 +-- block/qapi.c | 3 +++ include/block/accounting.h | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/block/accounting.c b/block/accounting.c index 6e06c7609e..038af37017 100644 --- a/block/accounting.c +++ b/block/accounting.c @@ -318,10 +318,9 @@ double block_acct_queue_depth(BlockAcctTimedStats *sta= ts, uint64_t sum, elapsed; =20 assert(type < BLOCK_MAX_IOTYPE); + assert(qemu_mutex_trylock(&stats->stats->lock) =3D=3D -EBUSY); =20 - qemu_mutex_lock(&stats->stats->lock); sum =3D timed_average_sum(&stats->latency[type], &elapsed); - qemu_mutex_unlock(&stats->stats->lock); =20 return (double) sum / elapsed; } diff --git a/block/qapi.c b/block/qapi.c index eabfbfc258..1dfac51091 100644 --- a/block/qapi.c +++ b/block/qapi.c @@ -535,6 +535,8 @@ static void bdrv_query_blk_stats(BlockDeviceStats *ds, = BlockBackend *blk) BlockAcctTimedStats *ts =3D NULL; BlockLatencyHistogram *hgram; =20 + qemu_mutex_lock(&stats->lock); + ds->rd_bytes =3D stats->nr_bytes[BLOCK_ACCT_READ]; ds->wr_bytes =3D stats->nr_bytes[BLOCK_ACCT_WRITE]; ds->zone_append_bytes =3D stats->nr_bytes[BLOCK_ACCT_ZONE_APPEND]; @@ -624,6 +626,7 @@ static void bdrv_query_blk_stats(BlockDeviceStats *ds, = BlockBackend *blk) =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_ZONE_APPEND]); ds->flush_latency_histogram =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_FLUSH]); + qemu_mutex_unlock(&stats->lock); } =20 static BlockStats * GRAPH_RDLOCK diff --git a/include/block/accounting.h b/include/block/accounting.h index b1cf417b57..12d3246092 100644 --- a/include/block/accounting.h +++ b/include/block/accounting.h @@ -116,6 +116,7 @@ void block_acct_invalid(BlockAcctStats *stats, enum Blo= ckAcctType type); void block_acct_merge_done(BlockAcctStats *stats, enum BlockAcctType type, int num_requests); int64_t block_acct_idle_time_ns(BlockAcctStats *stats); +/* Caller must hold stats->stats->lock. */ double block_acct_queue_depth(BlockAcctTimedStats *stats, enum BlockAcctType type); int block_latency_histogram_set(BlockAcctStats *stats, enum BlockAcctType = type, --=20 2.53.0 From nobody Sat Jul 25 06:37:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784891628; cv=none; d=zohomail.com; s=zohoarc; b=YtOhu5+8qzGzyWP5Fve9RVw+2WDpk7Bb3Sawb8grVRjbWr38PVZ0Pfm0BiB4M9onaD2YLWF3in4IonmjboD2dTtah6xr7lXRMLI8QiIuiWmU5k5mSgWOmRtSjakQEHPazn70o9no5G1U5PDXMYr9XbWaIcOGu8w8q2XwgwGXwxo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784891628; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=k8OM4Z+eBoFlDD0mCdq/zvHBMpMffPjuoO6NeF18+/M=; b=L3U4BQJ3x0lmkAQ30UkS+DnEiYRfocNzoaXxTbJs5YxBf/VGHQOxDjdltm+430rdDv7UQ/dthHQW4ZMquKZVKLlA2jrkztK9rgjycJ8Ku6KyOh1pFwimXCt7lb4FJfzBklvA/YHXLbylbU3OfwT6F3zlDhV8jyRibpwiNL35f7s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784891628119110.42804527220335; Fri, 24 Jul 2026 04:13:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnDqG-0001Vx-FJ; Fri, 24 Jul 2026 07:13:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnDqE-0001UV-4A for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:22 -0400 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wnDqC-0001m2-A4 for qemu-devel@nongnu.org; Fri, 24 Jul 2026 07:13:21 -0400 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-47f64ca1c2dso136228f8f.2 for ; Fri, 24 Jul 2026 04:13:19 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:4f7d:7b60:9d07:3a1b]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c531basm23792473f8f.19.2026.07.24.04.13.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 04:13:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784891599; x=1785496399; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k8OM4Z+eBoFlDD0mCdq/zvHBMpMffPjuoO6NeF18+/M=; b=hj5UUFnX5/ykPF1fmrcOoIOqkEg3fkB0KJu1gxxPfSbgySiUyO2WVymhg3Lwz3RVHn gl182zAyiAhgkYH+qf2TDuIm5Dv+fPJc6YfVp19CWtnbYfymttv2Lw5U9h1Q6Y5q+N6B LT2K/thwX0XHyNJvM1ei4M6CwHOBD4C0uPgfx2I2C709OsmHhsbNOMIZZYDMJeBIyQzA CfzG4vUn6WQBdNK4bAtlm4X12JRffdkYv0u0uta8ZqoQAC8o1QxuwysVQr5driiYJ2xm /oKGQk8BsaVRB/7El1PdJR9cZ1qLUZpRp+1KzLWOjVcXHmlI7k/+ASDrWozIHxRwuq7M FAAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784891599; x=1785496399; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=k8OM4Z+eBoFlDD0mCdq/zvHBMpMffPjuoO6NeF18+/M=; b=WZasa2Oi0aLD5mRH6zwRG1xG1/OwuM9Z7HIpV6HdpF+2aQUpfGB8xoG3lYhpS4Yum9 vwLEypsiK2kClld2cmX+Kxxo4kwenGlF1f0DLVXugSrc2lpbUwx9e4BsFyPhxni29Dtp IoazL7nN3XcAdKGg2eb2hbP9J6uVU5zmKRxrZn/DoMkDEdHH0GDgUknjeg3uopKInVme /bHfS6GDBVVRiGAOgXvyOdX/Y5BeDod9DLDNJjC7c5NV4Q/0Ex8S2Iy09vU0dZ586bfl xgcsNShn0iUvWvi9u+duxbCqH6dpEQd5nk3KxN8qQJ9FKALltv5ORvMANHf/JHOkML/m Uisw== X-Forwarded-Encrypted: i=1; AHgh+RpJy4DYuorZU/3OKNPIv/ifLlD8huqD6qjC5FhRC7qQQw7hIQ1gBoMpF3a1R/s4FR5kS6yrNj1oFkku@nongnu.org X-Gm-Message-State: AOJu0Yy+YPi/pNCHsG9ddoPU6QfRlg4aQVQ2izy7dMDjI3OaGIzqJIB0 uwFJV4bMrKnsLaIUFAdoJVwQkIFxkvDE9LXOZLZe+bA3AzME8gRF6WFsQ9vqGfd6lMs= X-Gm-Gg: AR+sD11ykdXb154tNJdCVnpUiocinopr3WtExQH44U9DqjjIK0k7Z9xDEqw5redPUA7 DHhzKYGLMFfQkJXLWpKTHugv7f/7UFrkpx8pBsOebO0pSFthHreOQdioxuGLst43YUX97sfYU5m CEHWMKqU01SZWFgHLO+1FCCPQPKoqHLIZRWEo24YKZtdteByLZ8ourclftptFH2G0/YqRSdGV5K fO1vHwFP67/T5K4QzAOQ7STL0hJ3t3seUc8CrytRssa3P5chdDIsFIbIlp+ndHRPuLYjn/xE03X sNE5RE/urVewfHyYpPTDN3BisyDxq7hZ0gUNo+PSLWWa12z5FMYMtme7G+ieidcftlx2mBkH6IS kSl42sIkmNwzS3QL9oiEiQD/XEypNI0P0ZcVHAM2T5U6f2X4tHvMkUNhx0gUs/+I62gSFVENoni 4= X-Received: by 2002:a05:6000:2506:b0:47f:95ce:6f48 with SMTP id ffacd0b85a97d-47f95ce6f84mr3768506f8f.11.1784891598629; Fri, 24 Jul 2026 04:13:18 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy , Andrey Drobyshev Subject: [PATCH v2 3/3] tests/unit: add reproducer for BlockAcctStats histogram locking race Date: Fri, 24 Jul 2026 13:13:11 +0200 Message-ID: <20260724111311.4086859-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724111311.4086859-1-den@openvz.org> References: <20260724111311.4086859-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::431; envelope-from=den@openvz.org; helo=mail-wr1-x431.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784891630300158500 Content-Type: text/plain; charset="utf-8" block_latency_histogram_set() and block_latency_histograms_clear() replace BlockLatencyHistogram's nbins/boundaries/bins without taking stats->lock, while block_account_one_io() reads those same fields under that lock from whatever iothread completes the I/O. Add a test that races two real threads against block_latency_histogram_set() and block_acct_start()/block_acct_done() on the same BlockAcctStats. Applied here it passes, since the previous two commits already take the lock; reverting them locally reproduces the abort this series fixes, in about a second. Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy CC: Andrey Drobyshev --- tests/unit/meson.build | 1 + tests/unit/test-block-accounting.c | 115 +++++++++++++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 tests/unit/test-block-accounting.c diff --git a/tests/unit/meson.build b/tests/unit/meson.build index 5ba6b1a230..dc3fb954c0 100644 --- a/tests/unit/meson.build +++ b/tests/unit/meson.build @@ -75,6 +75,7 @@ if have_block 'test-blockjob': [testblock], 'test-blockjob-txn': [testblock], 'test-block-backend': [testblock], + 'test-block-accounting': [testblock], 'test-block-iothread': [testblock], 'test-write-threshold': [testblock], 'test-crypto-hash': [crypto], diff --git a/tests/unit/test-block-accounting.c b/tests/unit/test-block-acc= ounting.c new file mode 100644 index 0000000000..7aae491cfc --- /dev/null +++ b/tests/unit/test-block-accounting.c @@ -0,0 +1,115 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * + * BlockAcctStats latency histogram locking regression test + * + * Copyright (c) 2026 Virtuozzo International GmbH. + * + * Regression test for missing stats->lock in + * block_latency_histogram_set()/block_latency_histograms_clear(), + * racing block_account_one_io() reading the same fields from an + * iothread. Aborts reliably before the fix, passes after it. + */ + +#include "qemu/osdep.h" +#include "block/block.h" +#include "block/accounting.h" +#include "system/block-backend.h" +#include "system/block-backend-io.h" +#include "qapi/error.h" +#include "qemu/main-loop.h" +#include "qemu/thread.h" + +#define RACE_DURATION_MS 2000 +#define NUM_READER_THREADS 8 + +static bool stop_workers; + +/* + * Different bin counts, so the writer's g_free()/g_new() churn can be + * caught mid-update. Values are small enough (nanoseconds) that plain + * back-to-back start/done calls exercise every bin without sleeping. + */ +static uint64List boundaries_a[] =3D { + { .next =3D &boundaries_a[1], .value =3D 1000 }, + { .next =3D &boundaries_a[2], .value =3D 5000 }, + { .next =3D NULL, .value =3D 50000 }, +}; + +static uint64List boundaries_b[] =3D { + { .next =3D &boundaries_b[1], .value =3D 800 }, + { .next =3D &boundaries_b[2], .value =3D 3000 }, + { .next =3D &boundaries_b[3], .value =3D 20000 }, + { .next =3D NULL, .value =3D 200000 }, +}; + +static void *writer_thread(void *opaque) +{ + BlockAcctStats *stats =3D opaque; + + while (!qatomic_read(&stop_workers)) { + block_latency_histogram_set(stats, BLOCK_ACCT_READ, boundaries_a); + block_latency_histogram_set(stats, BLOCK_ACCT_READ, boundaries_b); + block_latency_histograms_clear(stats); + } + + return NULL; +} + +static void *reader_thread(void *opaque) +{ + BlockAcctStats *stats =3D opaque; + + while (!qatomic_read(&stop_workers)) { + BlockAcctCookie cookie; + + block_acct_start(stats, &cookie, 4096, BLOCK_ACCT_READ); + block_acct_done(stats, &cookie); + } + + return NULL; +} + +static void test_latency_histogram_race(void) +{ + BlockBackend *blk =3D blk_new(qemu_get_aio_context(), + BLK_PERM_ALL, BLK_PERM_ALL); + BlockAcctStats *stats =3D blk_get_stats(blk); + QemuThread writer, readers[NUM_READER_THREADS]; + int i; + + /* Histogram has to be enabled (bins !=3D NULL) before racing it. */ + g_assert(block_latency_histogram_set(stats, BLOCK_ACCT_READ, + boundaries_a) =3D=3D 0); + + stop_workers =3D false; + qemu_thread_create(&writer, "hist-writer", writer_thread, stats, + QEMU_THREAD_JOINABLE); + for (i =3D 0; i < NUM_READER_THREADS; i++) { + qemu_thread_create(&readers[i], "hist-reader", reader_thread, stat= s, + QEMU_THREAD_JOINABLE); + } + + g_usleep(RACE_DURATION_MS * 1000); + qatomic_set(&stop_workers, true); + + qemu_thread_join(&writer); + for (i =3D 0; i < NUM_READER_THREADS; i++) { + qemu_thread_join(&readers[i]); + } + + blk_unref(blk); +} + +int main(int argc, char **argv) +{ + bdrv_init(); + qemu_init_main_loop(&error_abort); + + g_test_init(&argc, &argv, NULL); + + g_test_add_func("/block-accounting/latency_histogram_race", + test_latency_histogram_race); + + return g_test_run(); +} --=20 2.53.0