Bug 1281814

Patch posted.

Fix included in qemu-kvm-rhev-2.1.2-23.el7_1.11

host env (rhel7.1 release version + latest rhel7.1z kernel):
kernel: 3.10.0-229.24.2.el7.x86_64
qemu: qemu-kvm-rhev-2.1.2-23.el7_1.10.x86_64

guest env
kernel:3.10.0-229.el7.x86_64

Reproduce with cmd:
qemu-kvm -name rhel7.1 -m 4096 -machine pc,accel=kvm\
	-cpu host\
	-smp 2,cores=1,threads=1,sockets=2,maxcpus=4 \
	 -vga qxl\
	-spice port=3002,disable-ticketing \
	-serial unix:/tmp/m,server,nowait \
	-drive file=rhev71z.qcow2,if=none,id=drive-scsi-disk0,format=qcow2,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsi0 -device scsi-hd,drive=drive-scsi-disk0,bus=scsi0.0,scsi-id=0,lun=0,id=scsi-disk0,bootindex=1 \
	-monitor stdio \
	-chardev spiceport,id=charserial0,name=org.qemu.console.serial.0 -device isa-serial,chardev=charserial0,id=serial0 

steps:
In guest:
echo hello > /dev/ttyS1

qemu crash and stack trace:
#0  0x00007f7a3c72d5d7 in raise () from /lib64/libc.so.6
#1  0x00007f7a3c72ecc8 in abort () from /lib64/libc.so.6
#2  0x00007f7a3c726546 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007f7a3c7265f2 in __assert_fail () from /lib64/libc.so.6
#4  0x00007f7a43fa2aa3 in spice_chr_add_watch (chr=<optimized out>, 
    cond=<optimized out>) at spice-qemu-char.c:173
#5  0x00007f7a43f9f3d5 in qemu_chr_fe_add_watch (s=0x453e, 
    cond=(G_IO_PRI | unknown: 17728), cond@entry=(G_IO_OUT | G_IO_HUP), 
    func=0x7f7a44001730 <serial_xmit>, user_data=0x7f7a45ef8888)
    at qemu-char.c:3671
#6  0x00007f7a44001808 in serial_xmit (chan=chan@entry=0x0, 
    cond=cond@entry=G_IO_OUT, opaque=opaque@entry=0x7f7a45ef8888)
    at hw/char/serial.c:250
#7  0x00007f7a44001abb in serial_ioport_write (opaque=0x7f7a45ef8888, 
    addr=<optimized out>, val=<optimized out>, size=<optimized out>)
    at hw/char/serial.c:302
#8  0x00007f7a43ed6bca in access_with_adjusted_size (addr=addr@entry=0, 
    value=value@entry=0x7f7a32e93af0, size=size@entry=1, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=0x7f7a43ed6d40 <memory_region_write_accessor>, mr=0x7f7a45ef8930)
    at /usr/src/debug/qemu-2.1.2/memory.c:481
#9  0x00007f7a43edb797 in memory_region_dispatch_write (size=1, data=104, 
    addr=0, mr=0x7f7a45ef8930) at /usr/src/debug/qemu-2.1.2/memory.c:1143
---Type <return> to continue, or q <return> to quit---
#10 io_mem_write (mr=mr@entry=0x7f7a45ef8930, addr=0, val=<optimized out>, 
    size=1) at /usr/src/debug/qemu-2.1.2/memory.c:1976
#11 0x00007f7a43ea69e3 in address_space_rw (
    as=0x7f7a44534ba0 <address_space_io>, addr=addr@entry=760, 
    buf=0x7f7a43cc9000 <Address 0x7f7a43cc9000 out of bounds>, 
    len=len@entry=1, is_write=is_write@entry=true)
    at /usr/src/debug/qemu-2.1.2/exec.c:2092
#12 0x00007f7a43ed6050 in kvm_handle_io (count=1, size=1, 
    direction=<optimized out>, data=<optimized out>, port=760)
    at /usr/src/debug/qemu-2.1.2/kvm-all.c:1600
#13 kvm_cpu_exec (cpu=cpu@entry=0x7f7a45e2ba20)
    at /usr/src/debug/qemu-2.1.2/kvm-all.c:1742
#14 0x00007f7a43ec5152 in qemu_kvm_cpu_thread_fn (arg=0x7f7a45e2ba20)
    at /usr/src/debug/qemu-2.1.2/cpus.c:883
#15 0x00007f7a429c7df5 in start_thread () from /lib64/libpthread.so.0
#16 0x00007f7a3c7ee1ad in clone () from /lib64/libc.so.6


Verified this bug on qemu-kvm-rhev-2.1.2-23.el7_1.11.x86_64.

Steps is the same as above, qemu-kvm and guest works well.

So this bug has been fixed.

According to comment6, set this issue as verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0116.html