Bug 728385

Summary: attempting to take a screenshot of a VM with no graphics crashes qemu
Product: Red Hat Enterprise Linux 6 Reporter: Dave Allan <dallan>
Component: qemu-kvmAssignee: Gerd Hoffmann <kraxel>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.2CC: chayang, juzhang, minovotn, mkenneth, tburke, virt-maint, wdai
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: qemu-kvm-0.12.1.2-2.211.el6 Doc Type: Bug Fix
Doc Text:
Cause: Run qemu-kvm without graphics by passing -nographic argument and then try to do screendump. Consequence: Guest is destroyed as qemu-kvm crashes with segmentation fault. Fix: Check for valid screendump function pointer has been implemented prior to calling it. Result: qemu-kvm doesn't crash and continues running
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 11:33:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dave Allan 2011-08-04 21:55:36 UTC
Description of problem:
If I configure a guest with serial console only and then attempt to take a screenshot, qemu crashes.

Version-Release number of selected component (if applicable):
qemu-kvm-0.12.1.2-2.172.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. configure qemu without a graphics device
2. send monitor command:

screendump /path/to/file

Actual results:
qemu crashes

Expected results:
qemu returns an error

Additional info:
I have only reproduced this problem under libvirt, so I don't have a simple qemu command line reproducer.  If it's not trivially reproducible for you, let me know and I'll get you access to a system exhibiting the behavior.

Comment 2 Gerd Hoffmann 2011-08-12 08:50:54 UTC
Reproducer:
  /usr/libexec/qemu-kvm -nographic -vga none
  Type 'Ctrl-A c' to get the monitor prompt, then try screendump.

Upstream at least doesn't crash.  Doesn't report an error though.
Will look into this.

Comment 5 Chao Yang 2011-11-22 05:43:25 UTC
Reproduced this issue with steps and environment as follows: 
# uname -r;rpm -q qemu-kvm
2.6.32-220.el6.x86_64
qemu-kvm-0.12.1.2-2.209.el6.x86_64

1. configure qemu without a graphics device, say:
/usr/libexec/qemu-kvm -nographic -vga none -nographic -vga none
2. Type 'Ctrl-A c' to get the monitor and issue screendump /path/to/file

Actual Result:
(qemu) screendump /home/screen-file

Program received signal SIGSEGV, Segmentation fault.
vga_hw_screen_dump (filename=0xf4a9e0 "/home/screen-file") at console.c:181
181	    if (consoles[0]->hw_screen_dump)
(gdb) bt
#0  vga_hw_screen_dump (filename=0xf4a9e0 "/home/screen-file") at console.c:181
#1  0x0000000000412289 in do_screen_dump (mon=<value optimized out>, qdict=<value optimized out>, ret_data=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:1309
#2  0x0000000000412920 in monitor_call_handler (mon=<value optimized out>, cmd=0x591c58, params=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4105
#3  0x00000000004176f0 in handle_user_command (mon=0xf07870, cmdline=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4142
#4  0x000000000041781a in monitor_command_cb (mon=0xf07870, cmdline=<value optimized out>, opaque=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4697
#5  0x00000000004aba2b in readline_handle_byte (rs=0xf07ce0, ch=<value optimized out>) at readline.c:369
#6  0x0000000000417a3c in monitor_read (opaque=<value optimized out>, buf=0x7fffffffcf1f "\r", size=1) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4683
#7  0x00000000004bf79b in mux_chr_read (opaque=0xf07600, buf=0x7fffffffcf1f "\r", size=1) at qemu-char.c:442
#8  0x00000000004be1ff in qemu_chr_read (opaque=0xf07450) at qemu-char.c:170
#9  stdio_read (opaque=0xf07450) at qemu-char.c:794
#10 0x000000000040c43f in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4024
#11 0x000000000042aefa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#12 0x000000000040de85 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#13 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470


Marking qa_ack+ according to above info.

Comment 10 daiwei 2012-01-30 07:35:34 UTC
Reproduced this issue with steps and environment as follows: 
# uname -r;rpm -q qemu-kvm
2.6.32-220.el6.x86_64
qemu-kvm-0.12.1.2-2.207.el6.x86_64

1. configure qemu without a graphics device:
/usr/libexec/qemu-kvm -nographic -vga none 
2. Type 'Ctrl-A c' to get the monitor and issue screendump /path/to/file

Actual Result:
(qemu) screendump /tmp/screen-file1

Program received signal SIGSEGV, Segmentation fault.
vga_hw_screen_dump (filename=0xea69e0 "/tmp/screen-file1") at console.c:181
181         if (consoles[0]->hw_screen_dump)
(gdb) bt
#0  vga_hw_screen_dump (filename=0xea69e0 "/tmp/screen-file1") at console.c:181
#1  0x0000000000412239 in do_screen_dump (mon=<value optimized out>, qdict=<value optimized out>, ret_data=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:1309
#2  0x00000000004128d0 in monitor_call_handler (mon=<value optimized out>, cmd=0x591b18, params=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4105
#3  0x00000000004176a0 in handle_user_command (mon=0xe5e570, cmdline=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4142
#4  0x00000000004177ca in monitor_command_cb (mon=0xe5e570, cmdline=<value optimized out>, opaque=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4697
#5  0x00000000004ab98b in readline_handle_byte (rs=0xe5e9e0, ch=<value optimized out>) at readline.c:369
#6  0x00000000004179ec in monitor_read (opaque=<value optimized out>, buf=0x7fffffffcb8f "\r", size=1)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4683
#7  0x00000000004bf6fb in mux_chr_read (opaque=0xd6a650, buf=0x7fffffffcb8f "\r", size=1) at qemu-char.c:442
#8  0x00000000004be15f in qemu_chr_read (opaque=0xd5a490) at qemu-char.c:170
#9  stdio_read (opaque=0xd5a490) at qemu-char.c:794
#10 0x000000000040c3ef in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4024
#11 0x000000000042aeaa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#12 0x000000000040de35 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#13 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470


Verified this issue with steps and environment as follows: 
# uname -r;rpm -q qemu-kvm
 2.6.32-220.el6.x86_64
 qemu-kvm-0.12.1.2-2.213.el6.x86_64

1. configure qemu without a graphics device:
/usr/libexec/qemu-kvm -nographic -vga none 
2. Type 'Ctrl-A c' to get the monitor and issue screendump /path/to/file

Actual Result:
(qemu) screendump /tmp/screen-file2
(qemu) info status
VM status: running
3.check the result in host
# ls /tmp/screen-file2
ls: cannot access /tmp/screen-file2: No such file or directory


qemu neither crash nor report an error.According to Comment 2 ,this bug had been fixed.

Comment 12 Michal Novotny 2012-05-03 17:20:10 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
Run qemu-kvm without graphics by passing -nographic argument and then try to do screendump.

Consequence:
Guest is destroyed as qemu-kvm crashes with segmentation fault.

Fix:
Check for valid screendump function pointer has been implemented prior to calling it.

Result:
qemu-kvm doesn't crash and continues running

Comment 13 errata-xmlrpc 2012-06-20 11:33:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0746.html