qemu-io segfaults at block/io.c:2387

[nasastry]

cde:info Mirrored with LTC bug https://bugzilla.linux.ibm.com/show_bug.cgi?id=160753 </cde:info>

Re-production steps:

1. Copy the attached files named backing_img.qcow2.txt and test.img.txt to a directory
2. Rename them as

mv backing_img.qcow2.txt backing_img.qcow2
mv test.img.txt test.img

P.S. with filename extension as .qcow2 and .img, they are not getting attached here to changed to .txt.
3. And customize the following command to point to the above directory and run the same.
/usr/bin/qemu-io <path to>/test.img -c "discard 4115456 3203072"
Output of the above command.

qcow2_free_clusters failed: Invalid argument
qcow2: Image is corrupt: Cannot free unaligned cluster 0x3ffffe00; further non-fatal corruption events will be suppressed
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with refcount table); further corruption events will be suppressed
qcow2_free_clusters failed: Input/output error
qcow2_free_clusters failed: Invalid argument
qcow2_free_clusters failed: Input/output error
qcow2_free_clusters failed: Invalid argument
qcow2_free_clusters failed: Input/output error
Segmentation fault (core dumped)

from gdb:

(gdb) bt
#0  0x000000013017b494 in bdrv_co_pdiscard (bs=0x16083e7a0, offset=7307264, bytes=11264) at block/io.c:2387
#1  0x0000000130167b54 in blk_co_pdiscard (blk=0x16082e4a0, offset=4115456, bytes=<optimized out>) at block/block-backend.c:1445
#2  0x0000000130167c50 in blk_pdiscard_entry (opaque=0x7fffcf42b5d8) at block/block-backend.c:1851
#3  0x000000013023bc38 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at util/coroutine-ucontext.c:79
#4  0x00007fff9cf92b9c in makecontext () from /lib64/libc.so.6
#5  0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x000000013017b494 in bdrv_co_pdiscard (bs=0x16083e7a0, offset=7307264, bytes=11264) at block/io.c:2387
        num = <optimized out>
        req = {bs = 0x16083e7a0, offset = 4115456, bytes = 3203072, type = BDRV_TRACKED_DISCARD, serialising = false, overlap_offset = 4115456,
          overlap_bytes = 3203072, list = {le_next = 0x0, le_prev = 0x160841a18}, co = 0x1608601b0, wait_queue = {entries = {sqh_first = 0x0,
              sqh_last = 0x7fff99ecfe20}}, waiting_for = 0x0}
        max_pdiscard = 2147467264
        ret = <optimized out>
        head = 0
        tail = 11264
        align = 16384
        __PRETTY_FUNCTION__ = "bdrv_co_pdiscard"
#1  0x0000000130167b54 in blk_co_pdiscard (blk=0x16082e4a0, offset=4115456, bytes=<optimized out>) at block/block-backend.c:1445
        ret = <optimized out>
#2  0x0000000130167c50 in blk_pdiscard_entry (opaque=0x7fffcf42b5d8) at block/block-backend.c:1851
        rwco = 0x7fffcf42b5d8
#3  0x000000013023bc38 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at util/coroutine-ucontext.c:79
        arg = {p = 0x1608601b0, i = {1619394992, 1}}
        self = 0x1608601b0
        co = 0x1608601b0
#4  0x00007fff9cf92b9c in makecontext () from /lib64/libc.so.6
No symbol table info available.
#5  0x0000000000000000 in ?? ()
No symbol table info available.

Qemu version:
qemu-2.10.0-2.rel.gitc334a4e.el7.centos.ppc64le

Will attach the required image files.
backing_img.qcow2.txt
test.img.txt

These image files created by tests/image_fuzzer code from qemu source tree.

[cdeadmin]

------- Comment From muriloo@br.ibm.com 2017-12-28 12:18:35 EDT-------
This was fixed in HostOS QEMU 2.11.0 by the following commit (which is present in both hostos-devel and -release branches):

https://git.qemu.org/?p=qemu.git;a=commitdiff;h=d470ad42acfc73c45d3e8e

commit d470ad4
Author: Max Reitz <mreitz@redhat.com>
Date: Fri Nov 10 21:31:09 2017 +0100

block: Guard against NULL bs->drv

[cdeadmin]

------- Comment From nasastry@in.ibm.com 2018-01-01 01:07:41 EDT-------
Tested with qemu-img-2.11.0-1.rel.gite7153e0.el7.centos.ppc64le
reported segfault is not seen. This bugzilla can be closed.

/usr/bin/qemu-io /tmp/test.img -c "discard 4115456 3203072"

qcow2_free_clusters failed: Invalid argument
qcow2: Image is corrupt: Cannot free unaligned cluster 0x3ffffe00; further non-fatal corruption events will be suppressed
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with refcount table); further corruption events will be suppressed
qcow2_free_clusters failed: Input/output error
qcow2_free_clusters failed: Invalid argument
qcow2_free_clusters failed: Input/output error
qcow2_free_clusters failed: Invalid argument
qcow2_free_clusters failed: Input/output error
discard failed: No medium found