Bug 1411194

Summary: [abrt] qemu-system-x86: red_char_device_get_server(): qemu-system-x86_64 killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Chen_Min_Chin <tcfxfzoi>
Component: spiceAssignee: Christophe Fergeau <cfergeau>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 25CC: alexl, alon, amit.shah, berrange, cfergeau, crobinso, dwmw2, fziglio, hdegoede, itamar, jforbes, marcandre.lureau, pbonzini, rjones, sandmann, uril, virt-maint
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/c7975c0c410e1d69b9d4e542702e62e1b7926669
Whiteboard: abrt_hash:2ed23982983f9f0852484a8f6abdc56d10a11b2d;VARIANT_ID=workstation;
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-16 15:28:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Chen_Min_Chin 2017-01-09 03:34:01 UTC
Version-Release number of selected component:
qemu-system-x86-2.7.0-8.fc25

Additional info:
reporter:       libreport-2.8.0
backtrace_rating: 4
cmdline:        /usr/bin/qemu-system-x86_64 -enable-kvm -machine q35 -m 2G -smp 4 -boot menu=on -drive if=virtio,file=fedora25.qcow2,format=qcow2,l2-cache-size=15M,cache-clean-interval=900,cache=directsync,aio=native -device virtio-net,mac=52:54:00:12:56:90,netdev=userNet -netdev user,id=userNet -device virtio-net,mac=52:54:00:12:56:91,netdev=sockNet -netdev socket,mcast=230.0.0.1:1234,id=sockNet -vga virtio -balloon virtio,deflate-on-oom=true -soundhw all -usb -device virtio-keyboard-pci -device virtio-mouse-pci -device virtio-tablet-pci -device virtio-serial-pci -device virtserialport,chardev=spicechannel0,name=com.redhat.spice.0 -chardev spicevmc,id=spicechannel0,name=vdagent -device virtserialport,chardev=charchannel1,id=channel1,name=org.spice-space.webdav.0 -chardev spiceport,id=charchannel1,name=org.spice-space.webdav.0 -chardev spicevmc,id=spicechannel1,name=vdagent -device virtserialport,chardev=spicechannel1,name=org.qemu.guest_agent.0 -chardev spicevmc,name=usbredir,id=usbredirchardev1 -device usb-redir,chardev=usbredirchardev1,id=usbredirdev1,debug=3 -chardev spicevmc,name=usbredir,id=usbredirchardev2 -device usb-redir,chardev=usbredirchardev2,id=usbredirdev2,debug=3 -chardev spicevmc,name=usbredir,id=usbredirchardev3 -device usb-redir,chardev=usbredirchardev3,id=usbredirdev3,debug=3 -chardev spicevmc,name=usbredir,id=usbredirchardev4 -device usb-redir,chardev=usbredirchardev4,id=usbredirdev4,debug=3 -chardev spicevmc,name=usbredir,id=usbredirchardev5 -device usb-redir,chardev=usbredirchardev5,id=usbredirdev5,debug=3 -spice disable-ticketing,image-compression=auto_glz,unix,addr=/tmp/qbpwcf/qemu/spice-f25-sample.sock,gl=on -daemonize
crash_function: red_char_device_get_server
executable:     /usr/bin/qemu-system-x86_64
global_pid:     25258
kernel:         4.8.15-300.fc25.x86_64
pkg_fingerprint: 4089 D8F2 FDB1 9C98
pkg_vendor:     Fedora Project
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 red_char_device_get_server at char-device.c:978
 #1 spice_server_remove_interface at reds.c:3322
 #2 vmc_unregister_interface at /usr/src/debug/qemu-2.7.0/spice-qemu-char.c:134
 #3 set_guest_connected at /usr/src/debug/qemu-2.7.0/hw/char/virtio-console.c:91
 #4 handle_control_message at /usr/src/debug/qemu-2.7.0/hw/char/virtio-serial-bus.c:419
 #5 control_out at /usr/src/debug/qemu-2.7.0/hw/char/virtio-serial-bus.c:461
 #6 aio_dispatch at /usr/src/debug/qemu-2.7.0/aio-posix.c:330
 #7 aio_ctx_dispatch at /usr/src/debug/qemu-2.7.0/async.c:234
 #10 glib_pollfds_poll at /usr/src/debug/qemu-2.7.0/main-loop.c:213
 #11 os_host_main_loop_wait at /usr/src/debug/qemu-2.7.0/main-loop.c:258

Comment 1 Chen_Min_Chin 2017-01-09 03:34:12 UTC
Created attachment 1238552 [details]
File: backtrace

Comment 2 Chen_Min_Chin 2017-01-09 03:34:14 UTC
Created attachment 1238553 [details]
File: cgroup

Comment 3 Chen_Min_Chin 2017-01-09 03:34:16 UTC
Created attachment 1238554 [details]
File: core_backtrace

Comment 4 Chen_Min_Chin 2017-01-09 03:34:18 UTC
Created attachment 1238555 [details]
File: dso_list

Comment 5 Chen_Min_Chin 2017-01-09 03:34:20 UTC
Created attachment 1238556 [details]
File: environ

Comment 6 Chen_Min_Chin 2017-01-09 03:34:21 UTC
Created attachment 1238557 [details]
File: exploitable

Comment 7 Chen_Min_Chin 2017-01-09 03:34:23 UTC
Created attachment 1238558 [details]
File: limits

Comment 8 Chen_Min_Chin 2017-01-09 03:34:26 UTC
Created attachment 1238559 [details]
File: maps

Comment 9 Chen_Min_Chin 2017-01-09 03:34:28 UTC
Created attachment 1238560 [details]
File: mountinfo

Comment 10 Chen_Min_Chin 2017-01-09 03:34:30 UTC
Created attachment 1238561 [details]
File: namespaces

Comment 11 Chen_Min_Chin 2017-01-09 03:34:32 UTC
Created attachment 1238562 [details]
File: open_fds

Comment 12 Chen_Min_Chin 2017-01-09 03:34:33 UTC
Created attachment 1238563 [details]
File: proc_pid_status

Comment 13 Chen_Min_Chin 2017-01-09 03:34:35 UTC
Created attachment 1238564 [details]
File: var_log_messages

Comment 14 Cole Robinson 2017-01-09 14:12:50 UTC
*** Bug 1411335 has been marked as a duplicate of this bug. ***

Comment 15 Christophe Fergeau 2017-01-25 11:51:38 UTC
Were you doing anything special at the time of the crash? I've tried to reproduce with a fedora 25 q35 guest to be as close as possible to your setup. Logging out/restarting triggers the codepath which is shown in the backtrace, but I did not get a crash here.

Comment 16 Frediano Ziglio 2017-01-30 18:46:31 UTC
Have you noted that there are 2 vdagent devices configured? (Maybe not related but seems weird).

Comment 17 Christophe Fergeau 2017-01-31 14:48:36 UTC
Ah no, did not notice.
-chardev spicevmc,id=spicechannel1,name=vdagent -device virtserialport,chardev=spicechannel1,name=org.qemu.guest_agent.0
would be an invalid command line. libvirt seems to reject this though, so this VM would have been started manually ?

Comment 18 Christophe Fergeau 2017-01-31 16:13:25 UTC
Not a fix, but https://lists.freedesktop.org/archives/spice-devel/2017-January/035334.html should replace the crash with a warning.

Comment 19 Chen_Min_Chin 2017-02-02 14:38:30 UTC
(In reply to Christophe Fergeau from comment #17)
> Ah no, did not notice.
> -chardev spicevmc,id=spicechannel1,name=vdagent -device
> virtserialport,chardev=spicechannel1,name=org.qemu.guest_agent.0
> would be an invalid command line. libvirt seems to reject this though, so
> this VM would have been started manually ?

Yes, I just run this VM manually with qemu command.
I don't use libvirt.

I also use a fedora25 q35 guest, it wont't crash, but the 'Problem Reporting' tools will notice me theres is a bug.

So I should run this VM with only one spicevmc chardev named vdagent, right?

Comment 20 Christophe Fergeau 2017-02-03 10:42:11 UTC
(In reply to Chen_Min_Chin from comment #19)
> (In reply to Christophe Fergeau from comment #17)
> > Ah no, did not notice.
> > -chardev spicevmc,id=spicechannel1,name=vdagent -device
> > virtserialport,chardev=spicechannel1,name=org.qemu.guest_agent.0
> > would be an invalid command line. libvirt seems to reject this though, so
> > this VM would have been started manually ?
> 
> Yes, I just run this VM manually with qemu command.
> I don't use libvirt.
> 
> I also use a fedora25 q35 guest, it wont't crash, but the 'Problem
> Reporting' tools will notice me theres is a bug.
> 
> So I should run this VM with only one spicevmc chardev named vdagent, right?

Yes, QEMU command-line generated for the qemu agent is
-chardev socket,id=charchannel1,path=/some/path/org.qemu.guest_agent.0,server,nowait -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel1,id=channel1,name=org.qemu.guest_agent.0 
(corresponding XML is <channel type='unix'>
   <target type='virtio' name='org.qemu.guest_agent.0'/>
</channel> )

Comment 21 Christophe Fergeau 2017-02-03 10:43:47 UTC
https://cgit.freedesktop.org/spice/spice/commit/?id=1addd3c5148484bab04092f9086371fe74438dc4 has been pushed upstream, and should avoid the crash you were hitting.

Comment 22 Fedora End Of Life 2017-11-16 15:22:15 UTC
This message is a reminder that Fedora 25 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 25. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '25'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 25 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 23 Christophe Fergeau 2017-11-16 15:28:47 UTC
The fix for this was included in spice-server 0.14.0 which is available in fedora 25.