Bug 865718

Summary: qemu crashed when rhel6.3.x86_64 guest reboot
Product: Red Hat Enterprise Linux 6 Reporter: Xu Tian <xutian>
Component: qemu-kvmAssignee: Gerd Hoffmann <kraxel>
Status: CLOSED DUPLICATE QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 6.4CC: acathrow, akong, alevy, bsarathy, dyasny, juzhang, michen, mkenneth, virt-maint, xwei
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-10-15 07:43:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Xu Tian 2012-10-12 08:53:33 UTC 
Description of problem:

qemu crashed when rhel6.3.x86_64 guest reboot, and got in terminal Backtrace:

 *** glibc detected *** /usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu: free(): invalid next size (normal): 0x00007fb484d9d270 ***
 ======= Backtrace: =========
 /lib64/libc.so.6(+0x75366)[0x7fb47cc28366]
 /lib64/libc.so.6(+0x77e93)[0x7fb47cc2ae93]
 /usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu(+0xef3c3)[0x7fb47f3083c3]
....

 /lib64/libc.so.6(__libc_start_main+0xfd)[0x7fb47cbd1cdd]
 /usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu(+0x612d9)[0x7fb47f27a2d9]
please see full Backtrace info in attachment;

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.run acceptance with kvm-autotest tool check log of "rhel.6.3.64.reboot" test with kvm-autotest
  
Actual results:
qemu crashed 

Expected results:
guest reboot successful

Additional info:
tested packages:
qemu-kvm-0.12.1.2-2.322.el6.x86_64
host kernel: 2.6.32-323.el6.x86_64
guest kernel: 2.6.32-279.11.1.el6.x86_64
Comment 3 Amos Kong 2012-10-12 09:28:21 UTC 
Hi Xu,

You should provide the call trace by gdb.

# gdb /usr/libexec/qemu-kvm core
(gdb) bt
#0  0x00007fb47cbe58a5 in raise () from /lib64/libc.so.6
#1  0x00007fb47cbe7085 in abort () from /lib64/libc.so.6
#2  0x00007fb47cc22a37 in __libc_message () from /lib64/libc.so.6
#3  0x00007fb47cc28366 in malloc_printerr () from /lib64/libc.so.6
#4  0x00007fb47cc2ae93 in _int_free () from /lib64/libc.so.6
#5  0x00007fb47f3083c3 in qemu_spice_display_resize (ssd=0x7fb484d53ab0) at ui/spice-display.c:418
#6  0x00007fb47f2e53d6 in dpy_resize (ds=0x7fb47fd5d3a0, width=<value optimized out>, height=<value optimized out>) at console.h:250
#7  qemu_console_resize (ds=0x7fb47fd5d3a0, width=<value optimized out>, height=<value optimized out>) at console.c:1441
#8  0x00007fb47f3dd947 in vga_draw_graphic (opaque=0x7fb484d55dd0) at /usr/src/debug/qemu-kvm-0.12.1.2/hw/vga.c:1733
#9  vga_update_display (opaque=0x7fb484d55dd0) at /usr/src/debug/qemu-kvm-0.12.1.2/hw/vga.c:1945
#10 0x00007fb47f30804c in qemu_spice_display_refresh (ssd=0x7fb484d53ab0) at ui/spice-display.c:451
#11 0x00007fb47f27df7e in dpy_refresh (opaque=0x7fb47fd5d3a0) at /usr/src/debug/qemu-kvm-0.12.1.2/console.h:268
#12 gui_update (opaque=0x7fb47fd5d3a0) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3155
#13 0x00007fb47f27d8d0 in qemu_run_timers (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:1323
#14 main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4028
#15 0x00007fb47f29f31a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2244
#16 0x00007fb47f280315 in main_loop (argc=20, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4206
#17 main (argc=20, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6443
Comment 4 Xu Tian 2012-10-12 09:37:00 UTC 
(In reply to comment #3)
> Hi Xu,
> 
> You should provide the call trace by gdb.
> 
> # gdb /usr/libexec/qemu-kvm core
> (gdb) bt
> #0  0x00007fb47cbe58a5 in raise () from /lib64/libc.so.6
> #1  0x00007fb47cbe7085 in abort () from /lib64/libc.so.6
> #2  0x00007fb47cc22a37 in __libc_message () from /lib64/libc.so.6
> #3  0x00007fb47cc28366 in malloc_printerr () from /lib64/libc.so.6
> #4  0x00007fb47cc2ae93 in _int_free () from /lib64/libc.so.6
> #5  0x00007fb47f3083c3 in qemu_spice_display_resize (ssd=0x7fb484d53ab0) at
> ui/spice-display.c:418
> #6  0x00007fb47f2e53d6 in dpy_resize (ds=0x7fb47fd5d3a0, width=<value
> optimized out>, height=<value optimized out>) at console.h:250
> #7  qemu_console_resize (ds=0x7fb47fd5d3a0, width=<value optimized out>,
> height=<value optimized out>) at console.c:1441
> #8  0x00007fb47f3dd947 in vga_draw_graphic (opaque=0x7fb484d55dd0) at
> /usr/src/debug/qemu-kvm-0.12.1.2/hw/vga.c:1733
> #9  vga_update_display (opaque=0x7fb484d55dd0) at
> /usr/src/debug/qemu-kvm-0.12.1.2/hw/vga.c:1945
> #10 0x00007fb47f30804c in qemu_spice_display_refresh (ssd=0x7fb484d53ab0) at
> ui/spice-display.c:451
> #11 0x00007fb47f27df7e in dpy_refresh (opaque=0x7fb47fd5d3a0) at
> /usr/src/debug/qemu-kvm-0.12.1.2/console.h:268
> #12 gui_update (opaque=0x7fb47fd5d3a0) at
> /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3155
> #13 0x00007fb47f27d8d0 in qemu_run_timers (timeout=1000) at
> /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:1323
> #14 main_loop_wait (timeout=1000) at
> /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4028
> #15 0x00007fb47f29f31a in kvm_main_loop () at
> /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2244
> #16 0x00007fb47f280315 in main_loop (argc=20, argv=<value optimized out>,
> envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4206
> #17 main (argc=20, argv=<value optimized out>, envp=<value optimized out>)
> at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6443

I got reminder from xwei just now, I'm trying to to it and you have post it here; 
Hi boys, thanks all of your reminders;
Comment 6 Alon Levy 2012-10-15 07:25:55 UTC 
Hi Gerd,

 Assigning this to you as it seems to be in code you know best,

Thanks,
Alon
Comment 7 Gerd Hoffmann 2012-10-15 07:43:16 UTC 

*** This bug has been marked as a duplicate of bug 865767 ***