Bug 1260932

Summary: qemu-kvm will core dump when boot with >=50 pci-bridge(pci-bridge behind pci-bridge)
Product: Red Hat Enterprise Linux 7 Reporter: huiqingding <huding>
Component: qemu-kvm-rhevAssignee: Marcel Apfelbaum <marcel>
Status: CLOSED DUPLICATE QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.2CC: hhuang, huding, juli, juzhang, knoel, marcel, michen, mst, qiguo, rbalakri, virt-bugs, virt-maint, xfu, yama
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1058200 Environment:
Last Closed: 2015-12-23 13:43:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 1 huiqingding 2015-09-08 09:09:43 UTC
Version-Release number of selected component (if applicable):
qemu-kvm-rhev-2.3.0-22.el7.x86_64
kernel-3.10.0-313.el7.x86_64
seabios-bin-1.7.5-11.el7.noarch

1. boot guest with >=50 pci-bridge(pci-bridge behind pci-bridge)
# /usr/libexec/qemu-kvm -enable-kvm -M pc -smp 2,cores=2,threads=1,sockets=1 -m 2G -name vm1 -drive file=gluster://10.66.144.35/vol1/win10-64.raw,if=none,id=guest-img,format=raw,werror=stop,rerror=stop -device virtio-blk-pci,drive=guest-img,id=os-disk,bootindex=1 -vnc :6 -monitor unix:/tmp/mon,server,nowait -monitor stdio -boot menu=on,reboot-timeout=-1,strict=on -netdev tap,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown,id=tap1,vhost=on,queues=4 -device virtio-net-pci,netdev=tap1,id=nic1,mq=on,vectors=17,mac=1a:59:0a:4b:aa:94 -device pci-bridge,bus=pci.0,id=bridge0,chassis_nr=1,addr=0x5 -device pci-bridge,bus=bridge0,id=bridge1,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge1,id=bridge2,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge2,id=bridge3,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge3,id=bridge4,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge4,id=bridge5,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge5,id=bridge6,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge6,id=bridge7,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge7,id=bridge8,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge8,id=bridge9,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge9,id=bridge10,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge10,id=bridge11,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge11,id=bridge12,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge12,id=bridge13,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge13,id=bridge14,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge14,id=bridge15,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge15,id=bridge16,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge16,id=bridge17,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge17,id=bridge18,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge18,id=bridge19,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge19,id=bridge20,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge20,id=bridge21,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge21,id=bridge22,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge22,id=bridge23,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge23,id=bridge24,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge24,id=bridge25,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge25,id=bridge26,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge26,id=bridge27,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge27,id=bridge28,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge28,id=bridge29,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge29,id=bridge30,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge30,id=bridge31,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge31,id=bridge32,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge32,id=bridge33,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge33,id=bridge34,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge34,id=bridge35,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge35,id=bridge36,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge36,id=bridge37,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge37,id=bridge38,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge38,id=bridge39,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge39,id=bridge40,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge40,id=bridge41,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge41,id=bridge42,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge42,id=bridge43,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge43,id=bridge44,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge44,id=bridge45,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge45,id=bridge46,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge46,id=bridge47,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge47,id=bridge48,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge48,id=bridge49,chassis_nr=1,addr=0x1 -drive file=/home/disk/disk0.qcow2,if=none,id=drive-data,format=qcow2 -device virtio-blk-pci,bus=bridge49,addr=0x1,id=data-disk,drive=drive-data

Actual results:
(gdb) bt
#0  0x00007ffff06ed5d7 in raise () from /lib64/libc.so.6
#1  0x00007ffff06eecc8 in abort () from /lib64/libc.so.6
#2  0x00007ffff06e6546 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007ffff06e65f2 in __assert_fail () from /lib64/libc.so.6
#4  0x000055555563024c in register_savevm_live (dev=dev@entry=0x555559f31f40, idstr=idstr@entry=0x555555870c93 "virtio-blk", instance_id=<optimized out>, version_id=version_id@entry=2, ops=<optimized out>, 
    opaque=opaque@entry=0x555559f31f40) at /usr/src/debug/qemu-2.3.0/migration/savevm.c:514
#5  0x00005555556302b3 in register_savevm (dev=dev@entry=0x555559f31f40, idstr=idstr@entry=0x555555870c93 "virtio-blk", instance_id=<optimized out>, version_id=version_id@entry=2, 
    save_state=save_state@entry=0x555555632ec0 <virtio_blk_save>, load_state=0x555559f31f40, load_state@entry=0x555555632e60 <virtio_blk_load>, opaque=opaque@entry=0x555559f31f40)
    at /usr/src/debug/qemu-2.3.0/migration/savevm.c:531
#6  0x0000555555632de9 in virtio_blk_device_realize (dev=0x555559f31f40, errp=0x7fffffffc980) at /usr/src/debug/qemu-2.3.0/hw/block/virtio-blk.c:928
#7  0x000055555564f4cb in virtio_device_realize (dev=0x555559f31f40, errp=0x7fffffffc9c0) at /usr/src/debug/qemu-2.3.0/hw/virtio/virtio.c:1574
#8  0x000055555571db0d in device_set_realized (obj=0x555559f31f40, value=<optimized out>, errp=0x7fffffffcb20) at hw/core/qdev.c:1058
#9  0x00005555557ac02e in property_set_bool (obj=0x555559f31f40, v=<optimized out>, opaque=0x55555dac8430, name=<optimized out>, errp=0x7fffffffcb20) at qom/object.c:1514
#10 0x00005555557aebb7 in object_property_set_qobject (obj=0x555559f31f40, value=<optimized out>, name=0x5555558966bd "realized", errp=0x7fffffffcb20) at qom/qom-qobject.c:24
#11 0x00005555557ad640 in object_property_set_bool (obj=0x555559f31f40, value=<optimized out>, name=0x5555558966bd "realized", errp=0x7fffffffcb20) at qom/object.c:905
#12 0x0000555555795e6f in virtio_pci_realize (pci_dev=<optimized out>, errp=0x7fffffffcb20) at hw/virtio/virtio-pci.c:1445
#13 0x0000555555763cbf in pci_qdev_realize (qdev=0x555559f2a000, errp=0x7fffffffcba0) at hw/pci/pci.c:1856
#14 0x000055555571db0d in device_set_realized (obj=0x555559f2a000, value=<optimized out>, errp=0x7fffffffccd8) at hw/core/qdev.c:1058
#15 0x00005555557ac02e in property_set_bool (obj=0x555559f2a000, v=<optimized out>, opaque=0x55555dac8360, name=<optimized out>, errp=0x7fffffffccd8) at qom/object.c:1514
#16 0x00005555557aebb7 in object_property_set_qobject (obj=0x555559f2a000, value=<optimized out>, name=0x5555558966bd "realized", errp=0x7fffffffccd8) at qom/qom-qobject.c:24
#17 0x00005555557ad640 in object_property_set_bool (obj=obj@entry=0x555559f2a000, value=value@entry=true, name=name@entry=0x5555558966bd "realized", errp=errp@entry=0x7fffffffccd8) at qom/object.c:905
#18 0x00005555556cb8d4 in qdev_device_add (opts=0x555556959450) at qdev-monitor.c:574
#19 0x00005555556d4dd9 in device_init_func (opts=<optimized out>, opaque=<optimized out>) at vl.c:2159
#20 0x000055555586301b in qemu_opts_foreach (list=<optimized out>, func=func@entry=0x5555556d4dd0 <device_init_func>, opaque=opaque@entry=0x0, abort_on_failure=abort_on_failure@entry=1)
    at util/qemu-option.c:1059
#21 0x00005555555e57b2 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4274

Comment 4 Marcel Apfelbaum 2015-12-23 13:43:40 UTC
The symptoms are a little different but this is exactly the same bug.

*** This bug has been marked as a duplicate of bug 1176553 ***