Bug 1029172

Summary:	qemu-kvm experienced SIGABRT.
Product:	Red Hat Enterprise Linux 6	Reporter:	Gordon Watson <gwatson>
Component:	qemu-kvm	Assignee:	Jeff Cody <jcody>
Status:	CLOSED WORKSFORME	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	acathrow, bsarathy, chayang, jcody, juzhang, michen, mkenneth, qzhang, virt-maint
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-02-13 18:05:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gordon Watson 2013-11-11 20:30:36 UTC

Description of problem:

A customer provided us with a core file from 'qemu-kvm' from a RHEV host that was generated by a SIGABRT.

However, the core file is incomplete. It appears that they ran out of space in the file system.

Running 'gdb' with the relevant debuginfo packages installed shows;

# gdb /usr/libexec/qemu-kvm ./new_core.4944.1382972528.dump.1 
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-56.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/libexec/qemu-kvm...Reading symbols from /usr/lib/debug/usr/libexec/qemu-kvm.debug...done.
done.
BFD: Warning: /home/gfw/973701/./new_core.4944.1382972528.dump.1 is truncated: expected core file size >= 34780065792, found: 32672301056.
[New Thread 4944]
[New Thread 11480]
[New Thread 4948]
[New Thread 18424]
[New Thread 4951]
[New Thread 4950]
[New Thread 4949]
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/lib64/ld-2.12.so.debug...done.
done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Failed to read a valid object file image from memory.
Core was generated by `/usr/libexec/qemu-kvm -name syslga01r -S -M rhel6.3.0 -cpu Westmere -enable-kvm'.
Program terminated with signal 6, Aborted.
#0  0x00007fbed07cb8a5 in ?? ()
(gdb) bt
#0  0x00007fbed07cb8a5 in ?? ()
Cannot access memory at address 0x7fff7dc79648
(gdb) 


The question is, is there anything we can gather or assume from this at all ?  



Version-Release number of selected component (if applicable):

RHEL 6.4 RHEV host;
  qemu-kvm-rhev-0.12.1.2-2.355.el6_4.5.x86_64
  vdsm-4.10.2-23.0.el6ev.x86_64


How reproducible:

Only happened once.


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Gordon Watson 2013-11-11 20:39:31 UTC

The qemu log for the guest on the host in question contains;

2013-10-18 17:44:15.615+0000: starting up
LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin QEMU_AUDIO_DRV=none /usr/libexec/qemu-kvm -name syslga01r -S -M rhel6.3.0 -cpu Westmere -enable-kvm -m 32768 -smp 4,sockets=1,cores=4,threads=1 -uuid 52ef801d-fe38-4905-b8cb-d4780a57c454 -smbios type=1,manufacturer=Red Hat,product=RHEV Hypervisor,version=6Server-6.4.0.4.el6,serial=AA000000-0000-0000-0000-00000000004C_00:25:b5:aa:0b:a2,uuid=52ef801d-fe38-4905-b8cb-d4780a57c454 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/syslga01r.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=2013-10-18T17:44:14,driftfix=slew -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw,serial= -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -drive file=/rhev/data-center/c9468fe4-a11a-11e1-84d7-525400f80454/8c9882ac-7ae3-434d-9e30-7bdd303fc740/images/43383556-5246-400b-bfec-5827118d4987/aa7c3124-b3e8-4b03-9b23-129715cafe5f,if=none,id=drive-virtio-disk0,format=raw,serial=43383556-5246-400b-bfec-5827118d4987,cache=none,werror=stop,rerror=stop,aio=native -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -netdev tap,fd=32,id=hostnet0,vhost=on,vhostfd=34 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=00:1a:dd:1e:a6:48,bus=pci.0,addr=0x3 -netdev tap,fd=35,id=hostnet1,vhost=on,vhostfd=37 -device virtio-net-pci,__com_redhat_macvtap_compat=on,netdev=hostnet1,id=net1,mac=00:1a:dd:1e:d5:9b,bus=pci.0,addr=0x4 -chardev socket,id=charchannel0,path=/var/lib/libvirt/qemu/channels/syslga01r.com.redhat.rhevm.vdsm,server,nowait -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.rhevm.vdsm -chardev socket,id=charchannel1,path=/var/lib/libvirt/qemu/channels/syslga01r.org.qemu.guest_agent.0,server,nowait -device virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=org.qemu.guest_agent.0 -device usb-tablet,id=input0 -vnc 10.249.150.55:7,password -k en-us -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x7
*** glibc detected *** /usr/libexec/qemu-kvm: double free or corruption (!prev): 0x00007fbee5569090 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x3e624760e6)[0x7fbed080f0e6]
/lib64/libc.so.6(+0x3e62478c13)[0x7fbed0811c13]
/usr/libexec/qemu-kvm(+0xa0b8e)[0x7fbed2ea2b8e]
/usr/libexec/qemu-kvm(+0xa09ae)[0x7fbed2ea29ae]
/usr/libexec/qemu-kvm(+0x9d601)[0x7fbed2e9f601]
/usr/libexec/qemu-kvm(+0x66919)[0x7fbed2e68919]
/usr/libexec/qemu-kvm(+0x88e8a)[0x7fbed2e8ae8a]
/usr/libexec/qemu-kvm(main+0x1788)[0x7fbed2e6b518]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7fbed07b7cdd]
/usr/libexec/qemu-kvm(+0x631e9)[0x7fbed2e651e9]
======= Memory map: ========
7fb6a4000000-7fb6a402f000 rw-p 00000000 00:00 0 
........
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
2013-10-28 15:02:17.698+0000: shutting down