qemu-system-m68k: hw/scsi/scsi-disk.c assertion failure

Host environment

• Operating system: Gentoo Linux
• OS/kernel version: Linux 5.4.140
• Architecture: x86
• QEMU flavor: qemu-system-m68k
• QEMU version: 6.1.50 (v6.1.0-491-gbd662023)
• QEMU command line: qemu-system-m68k -M q800 -m 128M -serial none -serial mon:stdio -g 800x600x4 -rtc base=localtime -drive file=rootfs.ext2,format=raw -kernel vmlinux-5.14-multi -append "console=ttyS0" -initrd initramfs-stress-ng.cpio

Emulated/Virtualized environment

• Operating system: Linux/m68k
• OS/kernel version: Linux 5.14
• Architecture: m68k

Description of problem

QEMU assertion failure (crash): qemu-system-m68k: ../hw/scsi/scsi-disk.c:550: scsi_write_data: Assertion `r->req.aiocb == NULL' failed.

Steps to reproduce

$ xz -d initramfs-stress-ng.cpio.xz vmlinux-5.14-multi.xz
$ cat rootfs.ext2.xz-part? | xz -dc > rootfs.ext2
$ qemu-system-m68k -M q800 -m 128M -serial none -serial mon:stdio -g 800x600x4 -rtc base=localtime -drive file=rootfs.ext2,format=raw -kernel vmlinux-5.14-multi -append "console=ttyS0" -initrd initramfs-stress-ng.cpio 

ABCFGHIJK
[    0.000000] Linux version 5.14.0-multi (fthain@nippy) (m68k-linux-gnu-gcc (btc) 6.4.0, GNU ld (btc) 2.28) #5 Sat Sep 4 16:09:41 AEST 2021
[    0.000000] Saving 140 bytes of bootinfo
[    0.000000] Detected Macintosh model: 35
[    0.000000] Apple Macintosh Quadra 800
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x0000007fffffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] initrd: 07d3e000 - 07fff600
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Sorting __ex_table...
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 121420K/131072K available (4074K kernel code, 327K rwdata, 752K rodata, 148K init, 117K bss, 9652K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 200
[    0.000000] clocksource: via1: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 2439823894983 ns
[    0.000000] Console: colour dummy device 80x25
[    0.010000] printk: console [ttyS0] enabled
[    0.020000] Calibrating delay loop... 841.31 BogoMIPS (lpj=4206592)
[    0.110000] pid_max: default: 32768 minimum: 301
[    0.110000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.110000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.150000] devtmpfs: initialized
[    0.160000] random: get_random_u32 called from bucket_table_alloc.isra.28+0x70/0x1a6 with crng_init=0
[    0.160000] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.160000] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.160000] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.170000] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.170000] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.200000] wait_for_initramfs() called before rootfs_initcalls
[    0.220000] NuBus: Scanning NuBus slots.
[    0.220000] Slot 9: Board resource not found!
[    0.220000] SCSI subsystem initialized
[    0.240000] clocksource: Switched to clocksource via1
[    0.260000] NET: Registered PF_INET protocol family
[    0.260000] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.270000] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.270000] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.270000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.270000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.270000] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.270000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.270000] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.280000] RPC: Registered named UNIX socket transport module.
[    0.280000] RPC: Registered udp transport module.
[    0.280000] RPC: Registered tcp transport module.
[    0.280000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.290000] Trying to unpack rootfs image as initramfs...
[    0.290000] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.310000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[    0.310000] io scheduler mq-deadline registered
[    0.310000] macfb: framebuffer at 0xf9001000, mapped to 0x(ptrval), size 234k
[    0.310000] macfb: mode is 800x600x4, linelength=400
[    0.330000] Console: switching to colour frame buffer device 100x37
[    0.350000] fb0: DAFB frame buffer device
[    0.350000] pmac_zilog: 0.6 (Benjamin Herrenschmidt <benh@kernel.crashing.org>)
[    0.350000] scc.0: ttyS0 at MMIO 0x5000c022 (irq = 4, base_baud = 230400) is a Z85c30 ESCC - Serial port
[    0.350000] scc.1: ttyS1 at MMIO 0x5000c020 (irq = 4, base_baud = 230400) is a Z85c30 ESCC - Serial port
[    0.350000] Non-volatile memory driver v1.3
[    0.390000] brd: module loaded
[    0.390000] adb: Mac II ADB Driver v1.0 for Unified ADB
[    0.410000] Detected ADB keyboard, type ANSI.
[    0.410000] input: ADB keyboard as /devices/virtual/input/input0
[    0.420000] random: fast init done
[    0.420000] input: ADB mouse as /devices/virtual/input/input1
[    0.430000] Freeing initrd memory: 2820K
[    0.430000] mac_esp: using PDMA for controller 0
[    0.430000] mac_esp mac_esp.0: esp0: regs[(ptrval):0] irq[19]
[    0.430000] mac_esp mac_esp.0: esp0: is a ESP236, 16 MHz (ccf=4), SCSI ID 7
[    3.520000] scsi host0: esp
[    3.530000] scsi 0:0:0:0: Direct-Access     QEMU     QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
[    3.540000] scsi target0:0:0: Beginning Domain Validation
[    3.540000] scsi target0:0:0: Domain Validation skipping write tests
[    3.540000] scsi target0:0:0: Ending Domain Validation
[    3.550000] scsi 0:0:2:0: CD-ROM            QEMU     QEMU CD-ROM      2.5+ PQ: 0 ANSI: 5
[    3.550000] scsi target0:0:2: Beginning Domain Validation
[    3.560000] scsi target0:0:2: Domain Validation skipping write tests
[    3.560000] scsi target0:0:2: Ending Domain Validation
[    3.560000] sr 0:0:2:0: Power-on or device reset occurred
[    3.570000] sr 0:0:2:0: [sr0] scsi3-mmc drive: 16x/50x cd/rw xa/form2 cdda tray
[    3.570000] cdrom: Uniform CD-ROM driver Revision: 3.20
[    3.570000] sd 0:0:0:0: Power-on or device reset occurred
[    3.580000] sd 0:0:0:0: [sda] 322560 512-byte logical blocks: (165 MB/158 MiB)
[    3.580000] sd 0:0:0:0: [sda] Write Protect is off
[    3.580000] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[    3.590000] sd 0:0:0:0: Attached scsi generic sg0 type 0
[    3.590000] sr 0:0:2:0: Attached scsi generic sg1 type 5
[    3.590000] Onboard/comm-slot SONIC, revision 0x0004, 32 bit DMA, register offset 2
[    3.590000] SONIC ethernet @50f0a000, MAC 08:00:07:12:34:56, IRQ 3
[    3.600000] sd 0:0:0:0: [sda] Attached SCSI disk
[    3.610000] aoe: AoE v85 initialised.
[    3.610000] mousedev: PS/2 mouse device common for all mice
[    3.610000] rtc-generic rtc-generic: registered as rtc0
[    3.620000] NET: Registered PF_PACKET protocol family
[    3.630000] Freeing unused kernel image (initmem) memory: 148K
[    3.630000] This architecture does not have kernel memory protection.
[    3.630000] Run /init as init process
/init: line 11: ifconfig: not found
# mount /dev/sda /mnt
[    9.030000] EXT4-fs (sda): mounting ext2 file system using the ext4 subsystem
[    9.080000] EXT4-fs (sda): mounted filesystem without journal. Opts: (null). Quota mode: disabled.
# cd /mnt
# /root/stress-ng --mmap -1 --mmap-file --mmap-bytes=100%
stress-ng: info:  [42] defaulting to a 86400 second (1 day, 0.00 secs) run per stressor
stress-ng: info:  [42] dispatching hogs: 1 mmap
qemu-system-m68k: ../hw/scsi/scsi-disk.c:550: scsi_write_data: Assertion `r->req.aiocb == NULL' failed.
Aborted

Additional information