qemu segfaults when writing to very large qcow2 disk
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Create a ridiculously large qcow2 disk:
qemu-img create -f qcow2 test1.img $((2**63-513))
Attach it to a guest and try to use parted to partition it. This is easy with virt-rescue: you just do:
virt-rescue test1.img
><rescue> parted /dev/vda mklabel gpt
<-- bang! qemu segfaults here
The stack trace is:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000434cac in get_cluster_table (bs=0x3193030, offset=
92233720368
new_
506 l2_offset = s->l1_table[
(gdb) bt
#0 0x0000000000434cac in get_cluster_table (bs=0x3193030, offset=
92233720368
new_
#1 0x000000000043535b in qcow2_alloc_
92233720368
at block/qcow2-
#2 0x000000000043b8d4 in qcow2_co_writev (bs=0x3193030, sector_num=
18014398509
at block/qcow2.c:554
#3 0x0000000000428691 in bdrv_co_rw (opaque=0x38bad10) at block.c:2781
#4 0x000000000046e03a in coroutine_
at coroutine-
#5 0x00000034dc6471b0 in ?? () from /lib64/libc.so.6
#6 0x00007fff76cbb430 in ?? ()
#7 0x0000000000000000 in ?? ()
This is qemu from git (8f440cda08c6df574 from 2011-09-29)
Still happening in upstream qemu from git:
Program terminated with signal 11, Segmentation fault. entry=0x7f4f886 e7880, offset@ entry=115292150 4606834688, l2_table= new_l2_ table@entry= 0x7f4f8ad9a0b0, l2_index= new_l2_ index@entry= 0x7f4f8ad9a0ac) cluster. c:525 l1_index] & L1E_OFFSET_MASK; 15-3.fc18. x86_64 bluez-libs- 4.101-6. fc18.x86_ 64 brlapi- 0.5.6-12. fc18.x86_ 64 celt051- 0.5.1.3- 5.fc18. x86_64 ceph-devel- 0.56.3- 1.fc18. x86_64 ceph-libs- 0.56.3- 1.fc18. x86_64 cryptopp- 5.6.1-8. fc18.x86_ 64 cyrus-sasl- lib-2.1. 25-2.fc18. x86_64 leveldb- 1.7.0-4. fc18.x86_ 64 libfdt- 1.3.0-5. fc18.x86_ 64 libseccomp- 1.0.1-0. fc18.x86_ 64 libselinux- 2.1.12- 7.3.fc18. x86_64 libusbx- 1.0.14- 1.fc18. x86_64 snappy- 1.0.5-2. fc18.x86_ 64 spice-server- 0.12.2- 3.fc18. x86_64 usbredir- 0.6-1.fc18. x86_64 xen-libs- 4.2.1-9. fc18.x86_ 64 entry=0x7f4f886 e7880, offset@ entry=115292150 4606834688, new_l2_ table=new_ l2_table@ entry= index=new_ l2_index@ entry=0x7f4f8ad 9a0ac) cluster. c:525 <synthetic pointer>, host_offset= <synthetic pointer>, guest_offset= 06834688, bs=0x7f4f886e7880) at block/qcow2- cluster. c:873 cluster_ offset (bs=bs@ entry=0x7f4f886 e7880, <optimized out>, offset@ entry=115292150 4606834688, n_start@ entry=104, n_end=<optimized out>, num=num@entry= host_offset@ entry=0x7f4f8ad 9a150, m=m@entry= cluster. c:1217 85224, remaining_ sectors= 24, qiov=0x7f4f88d8 8f98) 85224, nb_sectors=24, qiov=0x7f4f88d8 8f98, flags=flags@entry= 0x7f4f88e16160) at block.c:4139 trampoline (i0=<optimized out>, ucontext. c:118
#0 0x00007f4f86c721a0 in get_cluster_table (bs=bs@
offset=
new_
new_
at block/qcow2-
525 l2_offset = s->l1_table[
Missing separate debuginfos, use: debuginfo-install SDL-1.2.
(gdb) bt
#0 0x00007f4f86c721a0 in get_cluster_table (bs=bs@
offset=
0x7f4f8ad9a0b0, new_l2_
at block/qcow2-
#1 0x00007f4f86c72fa3 in handle_copied (m=<optimized out>,
bytes=
11529215046
#2 qcow2_alloc_
offset=
n_start=
0x7f4f8ad9a14c, host_offset=
0x7f4f8ad9a158) at block/qcow2-
#3 0x00007f4f86c773b3 in qcow2_co_writev (bs=0x7f4f886e7880, sector_num=
22517998136
at block/qcow2.c:819
#4 0x00007f4f86c638d5 in bdrv_co_do_writev (bs=0x7f4f886e7880, sector_num=
22517998136
(unknown: 0)) at block.c:2625
#5 0x00007f4f86c63a38 in bdrv_co_do_rw (opaque=
#6 0x00007f4f86c9a19a in coroutine_
i1=<optimized out>) at coroutine-
#7 0x00007f4f7fd776c0 in ?? () from /lib64/libc.so.6
#8 0x00007fff125e6620 in ?? ()
#9 0x0000000000000000 in ?? ()