Bug 1043521

Summary: qemu with sandbox turned ON hangs when started with option '-device AC97,bus=pci.0,addr=03'
Product: [Fedora] Fedora Reporter: Rudá Moura <rmoura>
Component: qemuAssignee: Fedora Virtualization Maintainers <virt-maint>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 19CC: amit.shah, areis, berrange, cfergeau, crobinso, dwmw2, itamar, pbonzini, rjones, scottt.tw, virt-maint
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: qemu-1.4.2-15.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-31 01:54:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Rudá Moura 2013-12-16 14:36:45 UTC
Description of problem:

qemu with sandbox turned ON hangs when started with option '-device AC97,bus=pci.0,addr=03'

Version-Release number of selected component (if applicable):

qemu 1.4.2-14.fc19
qemu-1.6.1-2.fc19

How reproducible:

Always reproducible.

Steps to Reproduce:

1. Start qemu with sandbox on and AC97 audio device.

MALLOC_PERTURB_=1  /bin/qemu-kvm \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox on  \
    -M pc  \
    -nodefaults  \
    -vga std \
    -device AC97,bus=pci.0,addr=03  \
    -chardev socket,id=hmp_id_hmp1,path=/tmp/monitor-hmp1-20131213-153836-0fomwUBx,server,nowait \
    -mon chardev=hmp_id_hmp1,mode=readline  \
    -chardev socket,id=serial_id_serial0,path=/tmp/serial-serial0-20131213-153836-0fomwUBx,server,nowait \
    -device isa-serial,chardev=serial_id_serial0  \
    -chardev socket,id=seabioslog_id_20131213-153836-0fomwUBx,path=/tmp/seabios-20131213-153836-0fomwUBx,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20131213-153836-0fomwUBx,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=04 \
    -drive id=drive_image1,if=none,file=/home/rmoura/Work/virt-test.git/shared/data/images/jeos-19-64.qcow2 \
    -device virtio-blk-pci,id=image1,drive=drive_image1,bootindex=0,bus=pci.0,addr=05 \
    -device virtio-net-pci,mac=9a:30:31:32:33:34,id=idlBArnj,netdev=idbggS5l,bus=pci.0,addr=06  \
    -netdev user,id=idbggS5l,hostfwd=tcp::5000-:22  \
    -m 1024  \
    -smp 2,cores=1,threads=1,sockets=2  \
    -cpu 'SandyBridge' \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=none  \
    -boot order=cdn,once=c,menu=off \
    -enable-kvm

Actual results:

qemu hangs in defunct state (ps -ef | grep qemu shows it).

Expected results:

qemu running and accepting commands from console.

Additional info:

* qemu runs OK when removing option 'device AC97,bus=pci.0,addr=03'
* Bug verified on qemu-1.4.2-14.fc19 and qemu-1.6.1-2.fc19 (from virt-preview repository).
* qemu from upstream is clean/OK (commit e157b8fdd412d48eacfbb8c67d3d58780154faa3
)

Difference from qemu 1.6.1 and qemu upstream:

--- qemu-seccomp.c	2013-12-16 11:33:00.885893805 -0200
+++ /home/rmoura/Downloads/qemu.git/qemu-seccomp.c	2013-12-16 10:20:33.112077043 -0200
@@ -114,6 +114,7 @@
     { SCMP_SYS(write), 244 },
     { SCMP_SYS(fcntl), 243 },
     { SCMP_SYS(tgkill), 242 },
+    { SCMP_SYS(kill), 242 },
     { SCMP_SYS(rt_sigaction), 242 },
     { SCMP_SYS(pipe2), 242 },
     { SCMP_SYS(munmap), 242 },

From Audit log, after qemu hangs:

type=SECCOMP msg=audit(1387198745.332:635): auid=1000 uid=1000 gid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=28208 comm="qemu-system-x86" sig=31 syscall=62 compat=0 ip=0x7f6e134f9cd7 code=0x0

Note that syscall=62 is exactly sys_kill, so this syscall must be white listed.

I use virt-test to catch this bug, by running 'run -t qemu --tests=audio'. virt-test sets sandbox option ON by default.

Comment 1 Cole Robinson 2013-12-16 15:13:08 UTC
Thanks Ruda, moving to POST since there's a fix upstream.

Comment 2 Fedora Update System 2013-12-18 17:51:43 UTC
qemu-1.4.2-15.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/qemu-1.4.2-15.fc19

Comment 3 Fedora Update System 2013-12-20 01:52:30 UTC
Package qemu-1.4.2-15.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing qemu-1.4.2-15.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-23641/qemu-1.4.2-15.fc19
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2013-12-31 01:54:49 UTC
qemu-1.4.2-15.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.