Description of problem:

qemu with sandbox turned ON hangs when started with option '-device AC97,bus=pci.0,addr=03'

Version-Release number of selected component (if applicable):

qemu 1.4.2-14.fc19
qemu-1.6.1-2.fc19

How reproducible:

Always reproducible.

Steps to Reproduce:

1. Start qemu with sandbox on and AC97 audio device.

MALLOC_PERTURB_=1  /bin/qemu-kvm \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox on  \
    -M pc  \
    -nodefaults  \
    -vga std \
    -device AC97,bus=pci.0,addr=03  \
    -chardev socket,id=hmp_id_hmp1,path=/tmp/monitor-hmp1-20131213-153836-0fomwUBx,server,nowait \
    -mon chardev=hmp_id_hmp1,mode=readline  \
    -chardev socket,id=serial_id_serial0,path=/tmp/serial-serial0-20131213-153836-0fomwUBx,server,nowait \
    -device isa-serial,chardev=serial_id_serial0  \
    -chardev socket,id=seabioslog_id_20131213-153836-0fomwUBx,path=/tmp/seabios-20131213-153836-0fomwUBx,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20131213-153836-0fomwUBx,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=04 \
    -drive id=drive_image1,if=none,file=/home/rmoura/Work/virt-test.git/shared/data/images/jeos-19-64.qcow2 \
    -device virtio-blk-pci,id=image1,drive=drive_image1,bootindex=0,bus=pci.0,addr=05 \
    -device virtio-net-pci,mac=9a:30:31:32:33:34,id=idlBArnj,netdev=idbggS5l,bus=pci.0,addr=06  \
    -netdev user,id=idbggS5l,hostfwd=tcp::5000-:22  \
    -m 1024  \
    -smp 2,cores=1,threads=1,sockets=2  \
    -cpu 'SandyBridge' \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=none  \
    -boot order=cdn,once=c,menu=off \
    -enable-kvm

Actual results:

qemu hangs in defunct state (ps -ef | grep qemu shows it).

Expected results:

qemu running and accepting commands from console.

Additional info:

* qemu runs OK when removing option 'device AC97,bus=pci.0,addr=03'
* Bug verified on qemu-1.4.2-14.fc19 and qemu-1.6.1-2.fc19 (from virt-preview repository).
* qemu from upstream is clean/OK (commit e157b8fdd412d48eacfbb8c67d3d58780154faa3
)

Difference from qemu 1.6.1 and qemu upstream:

--- qemu-seccomp.c	2013-12-16 11:33:00.885893805 -0200
+++ /home/rmoura/Downloads/qemu.git/qemu-seccomp.c	2013-12-16 10:20:33.112077043 -0200
@@ -114,6 +114,7 @@
     { SCMP_SYS(write), 244 },
     { SCMP_SYS(fcntl), 243 },
     { SCMP_SYS(tgkill), 242 },
+    { SCMP_SYS(kill), 242 },
     { SCMP_SYS(rt_sigaction), 242 },
     { SCMP_SYS(pipe2), 242 },
     { SCMP_SYS(munmap), 242 },

From Audit log, after qemu hangs:

type=SECCOMP msg=audit(1387198745.332:635): auid=1000 uid=1000 gid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=28208 comm="qemu-system-x86" sig=31 syscall=62 compat=0 ip=0x7f6e134f9cd7 code=0x0

Note that syscall=62 is exactly sys_kill, so this syscall must be white listed.

I use virt-test to catch this bug, by running 'run -t qemu --tests=audio'. virt-test sets sandbox option ON by default.