vring_get_region_caches: Assertion `caches != NULL' failed.
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
qemu (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Undecided
|
Unassigned | ||
Disco |
Won't Fix
|
Undecided
|
Unassigned | ||
Eoan |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
QEMU crashes when passing through 8 GPU devices on an AMD Rome-based system which is configured (via BIOS) as a single NUMA domain.
[Test Case]
uvt-kvm create test
uvt-kvm wait test
uvt-kvm ssh test sudo poweroff
virsh edit test
# change:
# <driver name='qemu' type='qcow2'/>
# to:
# <driver name='qemu' type='qcow2' queues='128'/>
virsh start test
virsh console test
# QEMU will crash before booting into the kernel
[Fix]
the index into the bitmap array of batch_notify_vqs incremented itself by BITS_PER_LONG but then incorrectly indexed the unsigned long bitmap array by the full index value; when the number of vqs was under BITS_PER_LONG, the index was always 0, but once the number of vqs increased over BITS_PER_LONG, the bitmap array was indexed with (e.g. using BITS_PER_LONG == 64) bitmap[64] instead of bitmap[1]. Fix it to use the proper index by dividing the index counter by BITS_PER_LONG to get the bitmap array index.
[Regression Risk]
as this changes/fixes the index into an array, regressions would likely occur around notifications to the guest about virtio-blk device updates, or out-of-bounds errors in qemu itself, causing crash.
[Scope]
This is needed in b/e/f.
This bug was introduced by commit e21737ab150c274
This is fixed by commit 725fe5d10dbd425
[other info]
I added 'block-proposed' tags for b/e for this, to prevent release until after the patch has been released in focal.
Related branches
- Rafael David Tinoco (community): Approve
- Canonical Server packageset reviewers: Pending requested
- Canonical Server: Pending requested
-
Diff: 5913 lines (+5016/-118)30 files modifieddebian/binfmt-update-in (+4/-6)
debian/changelog (+3485/-0)
debian/control (+94/-25)
debian/control-in (+93/-21)
debian/kvm.arm32 (+2/-0)
debian/kvm.arm64 (+2/-0)
debian/kvm.powerpc (+13/-0)
debian/kvm.s390x (+2/-0)
debian/kvm.x86 (+1/-1)
debian/not-installed (+4/-0)
debian/patches/lp-1859527-virtio-blk-fix-out-of-bounds-access-to-bitmap-in-not.patch (+43/-0)
debian/patches/series (+10/-0)
debian/patches/ubuntu/define-ubuntu-machine-types.patch (+633/-0)
debian/patches/ubuntu/enable-svm-by-default.patch (+34/-0)
debian/patches/ubuntu/expose-vmx_qemu64cpu.patch (+17/-0)
debian/patches/ubuntu/lp-1857033-i386-Add-MSR-feature-bit-for-MDS-NO.patch (+37/-0)
debian/patches/ubuntu/lp-1857033-i386-Add-macro-for-stibp.patch (+40/-0)
debian/patches/ubuntu/lp-1857033-i386-Add-new-CPU-model-Cooperlake.patch (+99/-0)
debian/patches/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch (+62/-0)
debian/qemu-kvm-init (+89/-0)
debian/qemu-system-common.install (+1/-0)
debian/qemu-system-common.maintscript (+4/-0)
debian/qemu-system-common.qemu-kvm.default (+8/-0)
debian/qemu-system-common.qemu-kvm.service (+16/-0)
debian/qemu-system-data.install (+1/-1)
debian/qemu-system-x86.NEWS (+80/-0)
debian/qemu-system-x86.README.Debian (+47/-0)
debian/qemu-utils.install (+2/-0)
debian/rules (+93/-16)
dev/null (+0/-48)
Changed in qemu (Ubuntu Bionic): | |
status: | New → In Progress |
assignee: | nobody → dann frazier (dannf) |
tags: | added: block-proposed-bionic block-proposed-eoan sts |
description: | updated |
description: | updated |
Thread 1 (Thread 0x7f2a00963640 (LWP 15030)): unix/sysv/ linux/raise. c:51 assertion@ entry=0x5624a8e 2419e "caches != NULL", file=file@ entry=0x5624a8e 23b80 "/build/ qemu-XrmZRw/ qemu-2. 11+dfsg/ hw/virtio/ virtio. c", line=line@ entry=211, function= function@ entry=0x5624a8e 249f0 <__PRETTY_ FUNCTION_ _.30338> "vring_ get_region_ caches" ) at assert.c:92 assertion@ entry=0x5624a8e 2419e "caches != NULL", file=file@ entry=0x5624a8e 23b80 "/build/ qemu-XrmZRw/ qemu-2. 11+dfsg/ hw/virtio/ virtio. c", line=line@ entry=211, function= function@ entry=0x5624a8e 249f0 <__PRETTY_ FUNCTION_ _.30338> "vring_ get_region_ caches" ) at assert.c:101 region_ caches (vq=<optimized out>) at ./hw/virtio/ virtio. c:211 region_ caches (vq=<optimized out>) at ./hw/virtio/ virtio. c:1628 virtio. c:217 should_ notify (vdev=<optimized out>, vq=<optimized out>) at ./hw/virtio/ virtio. c:1632 342b0, vq=0x7f26a0655110) at ./hw/virtio/ virtio. c:1646 0x5624af93f420) at ./hw/block/ dataplane/ virtio- blk.c:71 entry=0x5624aa2 67fb0) at ./util/async.c:118 7fb0) at ./util/ aio-posix. c:436 <optimized out>) at ./util/async.c:261 context_ dispatch () from /usr/lib/ x86_64- linux-gnu/ libglib- 2.0.so. 0 main-loop. c:214 main_loop_ wait (timeout=<optimized out>) at ./util/ main-loop. c:261 <optimized out>) at ./util/ main-loop. c:515
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/
#1 0x00007f29fabdd801 in __GI_abort () at abort.c:79
#2 0x00007f29fabcd39a in __assert_fail_base (fmt=0x7f29fad547d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=
#3 0x00007f29fabcd412 in __GI___assert_fail (assertion=
#4 0x00005624a8a0bcbc in vring_get_
#5 0x00005624a8aa88d7 in vring_get_
#6 vring_avail_flags (vq=<optimized out>) at ./hw/virtio/
#7 virtio_
#8 0x00005624a8aaa0b5 in virtio_notify_irqfd (vdev=0x5624af9
#9 0x00005624a8a7c05f in notify_guest_bh (opaque=
#10 0x00005624a8ded30e in aio_bh_call (bh=0x5624af93ebd0) at ./util/async.c:90
#11 aio_bh_poll (ctx=ctx@
#12 0x00005624a8df0200 in aio_dispatch (ctx=0x5624aa26
#13 0x00005624a8ded1ee in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=
#14 0x00007f29fb9b7417 in g_main_
#15 0x00005624a8def457 in glib_pollfds_poll () at ./util/
#16 os_host_
#17 main_loop_wait (nonblocking=
#18 0x00005624a8a12ef6 in main_loop () at ./vl.c:1995
#19 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ./vl.c:4944