Bug 679006

"Connection reset by peer" is an indication the QEMU exited unexpectedly, most likely a crash. We need to capture a little more logging to libvirt so we can see what we're telling qemu todo

Can you enable logging in libvirtd.conf

  log_filters="1:qemu 1:util 1:security 1:libvirt"
  log_outputs="1:file:/var/log/libvirt/libvirtd.log"

And restart libvirtd, and then reproduce the crash & attach the libvirtd.log file

Yes, indeed. I can see qemu-kvm segfault in /var/log/messages.
...
Feb 22 05:18:07 dhcp-93-91 kernel: qemu-kvm[14747]: segfault at b8 ip 000000361b2165d6 sp 00007fff42af2f90 error 4 in libspice-server.so.1.0.2[361b200000+dd000]
...

libvirtd log have been attached.

Created attachment 480036 [details]
libvirtd log

I can't reproduce the crash myself. Can you try capture a stack trace of QEMU crashing 

 1. virsh start $GUEST
 2. gdb /usr/libexec/qemu-kvm $GUEST_PID
 3. virsh save $GUEST /tmp/$GUEST.save

And then 'thread apply all bt' when QEMU crashes.

(In reply to comment #5)
> I can't reproduce the crash myself. Can you try capture a stack trace of QEMU
> crashing 
> 
>  1. virsh start $GUEST
>  2. gdb /usr/libexec/qemu-kvm $GUEST_PID
>  3. virsh save $GUEST /tmp/$GUEST.save
> 
> And then 'thread apply all bt' when QEMU crashes.

I follow your steps, the gdb info is as following:
(gdb) c
Continuing.
[Thread 0x7fc38a3fc710 (LWP 14409) exited]
[New Thread 0x7fc38a3fc710 (LWP 14417)]
[Thread 0x7fc38a3fc710 (LWP 14417) exited]
[New Thread 0x7fc38a3fc710 (LWP 14424)]
[Thread 0x7fc38a3fc710 (LWP 14424) exited]
Detaching after fork from child process 14426.

Program received signal SIGSEGV, Segmentation fault.
reds_mig_switch (s=<value optimized out>) at reds.c:3379
3379	    migrate.port = s->port;
(gdb) thread apply all bt

Thread 4 (Thread 0x7fc3d27c3710 (LWP 14364)):
#0  0x0000003245a33a9d in sigtimedwait () from /lib64/libc.so.6
#1  0x000000000042db3f in kvm_main_loop_wait (env=0x1229a00, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1791
#2  0x000000000042e0e5 in kvm_main_loop_cpu (_env=0x1229a00) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1935
#3  ap_main_loop (_env=0x1229a00) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1982
#4  0x00000032462077e1 in start_thread () from /lib64/libpthread.so.0
#5  0x0000003245ae153d in clone () from /lib64/libc.so.6

Thread 3 (Thread 0x7fc38adfd710 (LWP 14365)):
#0  0x0000003245ae1b33 in epoll_wait () from /lib64/libc.so.6
#1  0x000000361b22c0c2 in red_worker_main (arg=<value optimized out>) at red_worker.c:10271
#2  0x00000032462077e1 in start_thread () from /lib64/libpthread.so.0
#3  0x0000003245ae153d in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7fc3d29f3940 (LWP 14341)):
#0  reds_mig_switch (s=<value optimized out>) at reds.c:3379
#1  spice_server_migrate_switch (s=<value optimized out>) at reds.c:4184
#2  0x00000000004df239 in notifier_list_notify (list=<value optimized out>) at notify.c:37
#3  0x000000000040baa0 in qemu_run_timers (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:1217
#4  main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4458
#5  0x000000000042b2fa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2165
#6  0x000000000040ef0f in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4634
#7  main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6848
(gdb) 



I am not sure if it is what you wanted, if not, please tell me.

This is perfect, it shows a bug in spice-server.

The 'reds_mig_switch' function is called unconditionally, whether libvirt has provided any client migrate info or not.  In save-to-disk, we obviously don't provide any migrate info. So 'reds->mig_spice' is NULL, but this is never checked, so 's->port' gets a NULL pointer crash


static void reds_mig_switch(void)
{
    RedsMigSpice *s = reds->mig_spice;
    SpiceMsgMainMigrationSwitchHost migrate;
    RedsOutItem *item;

    red_printf("");
    item = new_out_item(SPICE_MSG_MAIN_MIGRATE_SWITCH_HOST);

    migrate.port = s->port;

*** This bug has been marked as a duplicate of bug 674451 ***