Re: [PATCH v2 0/3] block/accounting: fix unlocked latency histogram reconfiguration races
Michael Tokarev <[email protected]> Tue, 4 Aug 2026 11:26:00 +0300
| Newsgroups | gmane.comp.emulators.qemu.block,gmane.comp.emulators.qemu,gmane.comp.emulators.qemu.stable |
|---|---|
| Message-ID | <[email protected]> |
On 7/24/26 14:13, Denis V. Lunev wrote: > block_latency_histogram_set() and block_latency_histograms_clear() > replace BlockLatencyHistogram's nbins/boundaries/bins without taking > stats->lock, while block_account_one_io() reads those same fields > under that lock from whatever iothread completes the I/O. A histogram > reconfiguration (block-latency-histogram-set QMP command, monitor > thread) racing an in-flight completion can therefore observe those > fields torn, hitting assert(pos != NULL) in > block_latency_histogram_account(), or corrupting the heap outright. > This showed up as a qemu-kvm SIGABRT on a customer's virtio-blk guest. > > Regression test is added for illustrative purpose but I am unsure that > it is viable long term. Feel free to drop. I'm picking this up for qemu-stable too. Please let me know if I shouldn't. And please remember to add Cc: qemu-stable@ for future changes which are applicable for the stable series, to avoid this extra round-trip :) Thanks, /mjt