Re: [PATCH v2 0/3] block/accounting: fix unlocked latency histogram reconfiguration races

Michael Tokarev <[email protected]> Tue, 4 Aug 2026 11:26:00 +0300
Newsgroups gmane.comp.emulators.qemu.block,gmane.comp.emulators.qemu,gmane.comp.emulators.qemu.stable
Message-ID <[email protected]>
On 7/24/26 14:13, Denis V. Lunev wrote:
> block_latency_histogram_set() and block_latency_histograms_clear()
> replace BlockLatencyHistogram's nbins/boundaries/bins without taking
> stats->lock, while block_account_one_io() reads those same fields
> under that lock from whatever iothread completes the I/O. A histogram
> reconfiguration (block-latency-histogram-set QMP command, monitor
> thread) racing an in-flight completion can therefore observe those
> fields torn, hitting assert(pos != NULL) in
> block_latency_histogram_account(), or corrupting the heap outright.
> This showed up as a qemu-kvm SIGABRT on a customer's virtio-blk guest.
> 
> Regression test is added for illustrative purpose but I am unsure that
> it is viable long term. Feel free to drop.

I'm picking this up for qemu-stable too.
Please let me know if I shouldn't.

And please remember to add Cc: qemu-stable@ for future changes which
are applicable for the stable series, to avoid this extra round-trip :)

Thanks,

/mjt