aio-posix: honor is_external in AioContext polling

AioHandlers marked ->is_external must be skipped when aio_node_check()
fails.  bdrv_drained_begin() needs this to prevent dataplane from
submitting new I/O requests while another thread accesses the device and
relies on it being quiesced.

This patch fixes the following segfault:

  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  0x00005577f6127dad in bdrv_io_plug (bs=0x5577f7ae52f0) at qemu/block/io.c:2650
  2650            bdrv_io_plug(child->bs);
  [Current thread is 1 (Thread 0x7ff5c4bd1c80 (LWP 10917))]
  (gdb) bt
  #0  0x00005577f6127dad in bdrv_io_plug (bs=0x5577f7ae52f0) at qemu/block/io.c:2650
  #1  0x00005577f6114363 in blk_io_plug (blk=0x5577f7b8ba20) at qemu/block/block-backend.c:1561
  #2  0x00005577f5d4091d in virtio_blk_handle_vq (s=0x5577f9ada030, vq=0x5577f9b3d2a0) at qemu/hw/block/virtio-blk.c:589
  #3  0x00005577f5d4240d in virtio_blk_data_plane_handle_output (vdev=0x5577f9ada030, vq=0x5577f9b3d2a0) at qemu/hw/block/dataplane/virtio-blk.c:158
  #4  0x00005577f5d88acd in virtio_queue_notify_aio_vq (vq=0x5577f9b3d2a0) at qemu/hw/virtio/virtio.c:1304
  #5  0x00005577f5d8aaaf in virtio_queue_host_notifier_aio_poll (opaque=0x5577f9b3d308) at qemu/hw/virtio/virtio.c:2134
  #6  0x00005577f60ca077 in run_poll_handlers_once (ctx=0x5577f79ddbb0) at qemu/aio-posix.c:493
  #7  0x00005577f60ca268 in try_poll_mode (ctx=0x5577f79ddbb0, blocking=true) at qemu/aio-posix.c:569
  #8  0x00005577f60ca331 in aio_poll (ctx=0x5577f79ddbb0, blocking=true) at qemu/aio-posix.c:601
  #9  0x00005577f612722a in bdrv_flush (bs=0x5577f7c20970) at qemu/block/io.c:2403
  #10 0x00005577f60c1b2d in bdrv_close (bs=0x5577f7c20970) at qemu/block.c:2322
  #11 0x00005577f60c20e7 in bdrv_delete (bs=0x5577f7c20970) at qemu/block.c:2465
  #12 0x00005577f60c3ecf in bdrv_unref (bs=0x5577f7c20970) at qemu/block.c:3425
  #13 0x00005577f60bf951 in bdrv_root_unref_child (child=0x5577f7a2de70) at qemu/block.c:1361
  #14 0x00005577f6112162 in blk_remove_bs (blk=0x5577f7b8ba20) at qemu/block/block-backend.c:491
  #15 0x00005577f6111b1b in blk_remove_all_bs () at qemu/block/block-backend.c:245
  #16 0x00005577f60c1db6 in bdrv_close_all () at qemu/block.c:2382
  #17 0x00005577f5e60cca in main (argc=20, argv=0x7ffea6eb8398, envp=0x7ffea6eb8440) at qemu/vl.c:4684

The key thing is that bdrv_close() uses bdrv_drained_begin() and
virtio_queue_host_notifier_aio_poll() must not be called.

Thanks to Fam Zheng <famz@redhat.com> for identifying the root cause of
this crash.

Reported-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Alberto Garcia <berto@igalia.com>
Message-id: 20170124095350.16679-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
1 file changed
tree: 64e1c203f10ebfff6813b02fcf8dfe85911240ff
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. contrib/
  6. crypto/
  7. default-configs/
  8. disas/
  9. docs/
  10. fpu/
  11. fsdev/
  12. gdb-xml/
  13. hw/
  14. include/
  15. io/
  16. libdecnumber/
  17. linux-headers/
  18. linux-user/
  19. migration/
  20. nbd/
  21. net/
  22. pc-bios/
  23. po/
  24. qapi/
  25. qga/
  26. qobject/
  27. qom/
  28. replay/
  29. roms/
  30. scripts/
  31. slirp/
  32. stubs/
  33. target/
  34. tcg/
  35. tests/
  36. trace/
  37. ui/
  38. util/
  39. .dir-locals.el
  40. .exrc
  41. .gitignore
  42. .gitmodules
  43. .mailmap
  44. .travis.yml
  45. accel.c
  46. aio-posix.c
  47. aio-win32.c
  48. arch_init.c
  49. async.c
  50. atomic_template.h
  51. balloon.c
  52. block.c
  53. blockdev-nbd.c
  54. blockdev.c
  55. blockjob.c
  56. bootdevice.c
  57. bt-host.c
  58. bt-vhci.c
  59. Changelog
  60. CODING_STYLE
  61. configure
  62. COPYING
  63. COPYING.LIB
  64. cpu-exec-common.c
  65. cpu-exec.c
  66. cpus-common.c
  67. cpus.c
  68. cputlb.c
  69. device-hotplug.c
  70. device_tree.c
  71. disas.c
  72. dma-helpers.c
  73. dump.c
  74. exec.c
  75. gdbstub.c
  76. HACKING
  77. hax-stub.c
  78. hmp-commands-info.hx
  79. hmp-commands.hx
  80. hmp.c
  81. hmp.h
  82. iohandler.c
  83. ioport.c
  84. iothread.c
  85. kvm-all.c
  86. kvm-stub.c
  87. LICENSE
  88. main-loop.c
  89. MAINTAINERS
  90. Makefile
  91. Makefile.objs
  92. Makefile.target
  93. memory.c
  94. memory_ldst.inc.c
  95. memory_mapping.c
  96. module-common.c
  97. monitor.c
  98. numa.c
  99. os-posix.c
  100. os-win32.c
  101. page_cache.c
  102. qapi-schema.json
  103. qdev-monitor.c
  104. qdict-test-data.txt
  105. qemu-bridge-helper.c
  106. qemu-char.c
  107. qemu-doc.texi
  108. qemu-ga.texi
  109. qemu-img-cmds.hx
  110. qemu-img.c
  111. qemu-img.texi
  112. qemu-io-cmds.c
  113. qemu-io.c
  114. qemu-nbd.c
  115. qemu-nbd.texi
  116. qemu-option-trace.texi
  117. qemu-options-wrapper.h
  118. qemu-options.h
  119. qemu-options.hx
  120. qemu-seccomp.c
  121. qemu-tech.texi
  122. qemu-timer.c
  123. qemu.nsi
  124. qemu.sasl
  125. qmp.c
  126. qtest.c
  127. README
  128. replication.c
  129. replication.h
  130. rules.mak
  131. softmmu_template.h
  132. spice-qemu-char.c
  133. tcg-runtime.c
  134. tci.c
  135. thread-pool.c
  136. thunk.c
  137. tpm.c
  138. trace-events
  139. translate-all.c
  140. translate-all.h
  141. translate-common.c
  142. user-exec-stub.c
  143. user-exec.c
  144. VERSION
  145. version.rc
  146. vl.c
  147. xen-common-stub.c
  148. xen-common.c
  149. xen-hvm-stub.c
  150. xen-hvm.c
  151. xen-mapcache.c