Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1176540

Summary: qemu core dumped when assign all the device behind the 9th pci-bridge
Product: Red Hat Enterprise Linux 7 Reporter: Sibiao Luo <sluo>
Component: qemu-kvm-rhevAssignee: Marcel Apfelbaum <marcel>
Status: CLOSED DUPLICATE QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 7.1CC: chayang, juzhang, michen, qzhang, shuang, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-24 10:46:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sibiao Luo 2014-12-22 09:51:49 UTC 
Description of problem:
as subject, qemu core dumped when assign all the device behind the 9th pci-bridge. Tried it to the 8th pci-bridge which did not meet core dumped. If all the device connected to the first pci-bridge which did not meet core dumped.

Version-Release number of selected component (if applicable):
host info:
3.10.0-217.el7.x86_64
qemu-kvm-rhev-2.1.2-17.el7.x86_64
seabios-1.7.5-6.el7.x86_64
guest info:
rhel6.6-z, 2.6.32-504.6.1.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1.assign all the device behind the 9th pci-bridge.
2.
3.

Actual results:
after step 1, qemu will core dumped.
QEMU 2.1.2 monitor - type 'help' for more information
(qemu) *** stack smashing detected ***: /usr/libexec/qemu-kvm terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f678f615937]
/lib64/libc.so.6(__fortify_fail+0x0)[0x7f678f615900]
/usr/libexec/qemu-kvm(+0x1eb805)[0x7f6796d6d805]
/usr/libexec/qemu-kvm(+0x18ca85)[0x7f6796d0ea85]
/usr/libexec/qemu-kvm(+0x2267b2)[0x7f6796da87b2]
/usr/libexec/qemu-kvm(+0x2f5c97)[0x7f6796e77c97]
/usr/libexec/qemu-kvm(+0x86137)[0x7f6796c08137]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f678f529af5]
/usr/libexec/qemu-kvm(+0x8aaed)[0x7f6796c0caed]
======= Memory map: ========
7f6664000000-7f6664224000 rw-p 00000000 00:00 0 
7f6664224000-7f6668000000 ---p 00000000 00:00 0 
7f666c000000-7f676c000000 rw-p 00000000 00:00 0 
7f676c000000-7f676c021000 rw-p 00000000 00:00 0 
7f676c021000-7f6770000000 ---p 00000000 00:00 0 
7f6770000000-7f6770021000 rw-p 00000000 00:00 0 
7f6770021000-7f6774000000 ---p 00000000 00:00 0 
7f67751fe000-7f67751ff000 ---p 00000000 00:00 0 
7f67751ff000-7f67759ff000 rw-p 00000000 00:00 0                          [stack:31171]
7f67759ff000-7f6775a00000 ---p 00000000 00:00 0 
7f6775a00000-7f6776200000 rw-p 00000000 00:00 0                          [stack:31170]
7f6776200000-7f6776240000 rw-p 00000000 00:00 0 
7f6776400000-7f6776410000 rw-p 00000000 00:00 0 
7f6776600000-7f6777600000 rw-p 00000000 00:00 0 
7f67776d2000-7f67777ff000 rw-p 00000000 00:00 0 
7f67777ff000-7f6777800000 ---p 00000000 00:00 0 
7f6777800000-7f6778000000 rw-p 00000000 00:00 0                          [stack:31144]
7f6778000000-7f6778021000 rw-p 00000000 00:00 0 
7f6778021000-7f677c000000 ---p 00000000 00:00 0 
7f677c000000-7f677c021000 rw-p 00000000 00:00 0 
7f677c021000-7f6780000000 ---p 00000000 00:00 0 
7f6780000000-7f6780021000 rw-p 00000000 00:00 0 
7f6780021000-7f6784000000 ---p 00000000 00:00 0 
7f67840d3000-7f6784200000 rw-p 00000000 00:00 0 
7f6784200000-7f6784220000 rw-p 00000000 00:00 0 
7f67842b2000-7f6784400000 rw-p 00000000 00:00 0 
7f6784400000-7f6784440000 rw-p 00000000 00:00 0 
7f678444b000-7f6784567000 rw-p 00000000 00:00 0 
7f6784567000-7f6784568000 ---p 00000000 00:00 0 
7f6784568000-7f6784d68000 rw-p 00000000 00:00 0                          [stack:31142]
7f6784d68000-7f6784d69000 ---p 00000000 00:00 0 
7f6784d69000-7f6785569000 rw-p 00000000 00:00 0                          [stack:31136]
7f6785569000-7f678556a000 ---p 00000000 00:00 0 
7f678556a000-7f678605c000 rw-p 00000000 00:00 0                          [stack:31125]
7f678605c000-7f678605d000 ---p 00000000 00:00 0 
7f678605d000-7f678685d000 rw-p 00000000 00:00 0                          [stack:31115]
7f678685d000-7f6786861000 r-xp 00000000 fd:00 202851106                  /usr/lib64/sasl2/libplain.so.3.0.0
7f6786861000-7f6786a60000 ---p 00004000 fd:00 202851106                  /usr/lib64/sasl2/libplain.so.3.0.0
7f6786a60000-7f6786a61000 r--p 00003000 fd:00 202851106                  /usr/lib64/sasl2/libplain.so.3.0.0
7f6786a61000-7f6786a62000 rw-p 00004000 fd:00 202851106                  /usr/lib64/sasl2/libplain.so.3.0.0
7f6786a62000-7f6786a66000 r-xp 00000000 fd:00 202851103                  /usr/lib64/sasl2/liblogin.so.3.0.0
7f6786a66000-7f6786c65000 ---p 00004000 fd:00 202851103                  /usr/lib64/sasl2/liblogin.so.3.0.0
7f6786c65000-7f6786c66000 r--p 00003000 fd:00 202851103                  /usr/lib64/sasl2/liblogin.so.3.0.0
7f6786c66000-7f6786c67000 rw-p 00004000 fd:00 202851103                  /usr/lib64/sasl2/liblogin.so.3.0.0
7f6786c67000-7f6786c74000 r-xp 00000000 fd:00 202160095                  /usr/lib64/sasl2/libdigestmd5.so.3.0.0
7f6786c74000-7f6786e73000 ---p 0000d000 fd:00 202160095                  /usr/lib64/sasl2/libdigestmd5.so.3.0.0
7f6786e73000-7f6786e74000 r--p 0000c000 fd:00 202160095                  /usr/lib64/sasl2/libdigestmd5.so.3.0.0
7f6786e74000-7f6786e75000 rw-p 0000d000 fd:00 202160095                  /usr/lib64/sasl2/libdigestmd5.so.3.0.0
7f6786e75000-7f6786e7a000 r-xp 00000000 fd:00 202160092                  /usr/lib64/sasl2/libcrammd5.so.3.0.0
7f6786e7a000-7f6787079000 ---p 00005000 fd:00 202160092                  /usr/lib64/sasl2/libcrammd5.so.3.0.0
7f6787079000-7f678707a000 r--p 00004000 fd:00 202160092                  /usr/lib64/sasl2/libcrammd5.so.3.0.0
7f678707a000-7f678707b000 rw-p 00005000 fd:00 202160092                  /usr/lib64/sasl2/libcrammd5.so.3.0.0
7f678707b000-7f678722f000 r-xp 00000000 fd:00 201329100                  /usr/lib64/libdb-5.3.so
7f678722f000-7f678742f000 ---p 001b4000 fd:00 201329100                  /usr/lib64/libdb-5.3.so
7f678742f000-7f6787436000 r--p 001b4000 fd:00 201329100                  /usr/lib64/libdb-5.3.so
7f6787436000-7f6787439000 rw-p 001bb000 fd:00 201329100                  /usr/lib64/libdb-5.3.so
7f6787439000-7f678743f000 r-xp 00000000 fd:00 201329110                  /usr/lib64/sasl2/libsasldb.so.3.0.0
7f678743f000-7f678763e000 ---p 00006000 fd:00 201329110                  /usr/lib64/sasl2/libsasldb.so.3.0.0
7f678763e000-7f678763f000 r--p 00005000 fd:00 201329110                  /usr/lib64/sasl2/libsasldb.so.3.0.0
7f678763f000-7f6787640000 rw-p 00006000 fd:00 201329110                  /usr/lib64/sasl2/libsasldb.so.3.0.0
7f6787640000-7f6787644000 r-xp 00000000 fd:00 201329107                  /usr/lib64/sasl2/libanonymous.so.3.0.0
7f6787644000-7f6787843000 ---p 00004000 fd:00 201329107                  /usr/lib64/sasl2/libanonymous.so.3.0.0
7f6787843000-7f6787844000 r--p 00003000 fd:00 201329107                  /usr/lib64/sasl2/libanonymous.so.3.0.0
7f6787844000-7f6787845000 rw-p 00004000 fd:00 201329107                  /usr/lib64/sasl2/libanonymous.so.3.0.0
7f6787845000-7f6787869000 r-xp 00000000 fd:00 201328533                  /usr/lib64/liblzma.so.5.0.99
7f6787869000-7f6787a68000 ---p 00024000 fd:00 201328533                  /usr/lib64/liblzma.so.5.0.99
7f6787a68000-7f6787a69000 r--p 00023000 fd:00 201328533                  /usr/lib64/liblzma.so.5.0.99
7f6787a69000-7f6787a6a000 rw-p 00024000 fd:00 201328533                  /usr/lib64/liblzma.so.5.0.99
7f6787a6a000-7f6787ac9000 r-xp 00000000 fd:00 201328541                  /usr/lib64/libpcre.so.1.2.0
7f6787ac9000-7f6787cc9000 ---p 0005f000 fd:00 201328541                  /usr/lib64/libpcre.so.1.2.0
7f6787cc9000-7f6787cca000 r--p 0005f000 fd:00 201328541                  /usr/lib64/libpcre.so.1.2.0
7f6787cca000-7f6787ccb000 rw-p 00060000 fd:00 201328541                  /usr/lib64/libpcre.so.1.2.0
7f6787ccb000-7f6787cec000 r-xp 00000000 fd:00 201328582                  /usr/lib64/libselinux.so.1
7f6787cec000-7f6787eec000 ---p 00021000 fd:00 201328582                  /usr/lib64/libselinux.so.1
7f6787eec000-7f6787eed000 r--p 00021000 fd:00 201328582                  /usr/lib64/libselinux.so.1
7f6787eed000-7f6787eee000 rw-p 00022000 fd:00 201328582                  /usr/lib64/libselinux.so.1Aborted (core dumped)

Expected results:
It should no any core dumped.

Additional info:
# /usr/libexec/qemu-kvm -machine type=pc,dump-guest-core=off -S -cpu SandyBridge -enable-kvm -m 4096 -smp 4,sockets=2,cores=2,threads=1 -no-kvm-pit-reinjection -usb -device usb-tablet,id=input0 -name sluo -uuid 990ea161-6b67-47b2-b803-19fb01d30d11 -rtc base=localtime,clock=host,driftfix=slew -device pci-bridge,bus=pci.0,id=bridge1,chassis_nr=1,addr=0x3 -device pci-bridge,bus=bridge1,id=bridge2,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge2,id=bridge3,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge3,id=bridge4,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge4,id=bridge5,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge5,id=bridge6,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge6,id=bridge7,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge7,id=bridge8,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge8,id=bridge9,chassis_nr=1,addr=0x1 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=0,bus=bridge9,addr=0x4 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm0,bus=virtio-serial0.0,id=port1 -chardev socket,id=channel2,path=/tmp/helloworld2,server,nowait -device virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm1,bus=virtio-serial0.0,id=port2 -drive file=/home/RHEL-Server-6.6.z-64-virtio-scsi.qcow2,if=none,id=drive-system-disk,format=qcow2,cache=none,aio=native,werror=stop,rerror=stop -device virtio-blk-pci,bus=bridge9,addr=0x5,drive=drive-system-disk,id=system-disk,bootindex=1 -netdev tap,id=hostnet0,vhost=on,queues=4,script=/etc/qemu-ifup -device virtio-net-pci,mq=on,vectors=17,netdev=hostnet0,id=virtio-net-pci0,mac=08:2e:5f:0a:0d:b1,bus=bridge9,addr=0x6,bootindex=2 -device virtio-balloon-pci,id=ballooning,bus=bridge9,addr=0x7 -global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 -k en-us -boot menu=on -qmp tcp:0:4444,server,nowait -serial unix:/tmp/ttyS0,server,nowait -vnc :1 -spice disable-ticketing,port=5931 -monitor stdio
Comment 1 Sibiao Luo 2014-12-22 09:53:26 UTC 
Core was generated by `/usr/libexec/qemu-kvm -machine type=pc,dump-guest-core=off -S -cpu SandyBridge'.
Program terminated with signal 6, Aborted.
#0  0x00007f678f53d5d7 in raise () from /lib64/libc.so.6

(gdb) bt
#0  0x00007f678f53d5d7 in raise () from /lib64/libc.so.6
#1  0x00007f678f53ecc8 in abort () from /lib64/libc.so.6
#2  0x00007f678f57de27 in __libc_message () from /lib64/libc.so.6
#3  0x00007f678f615937 in __fortify_fail () from /lib64/libc.so.6
#4  0x00007f678f615900 in __stack_chk_fail () from /lib64/libc.so.6
#5  0x00007f6796d6d805 in qdev_get_fw_dev_path (dev=<optimized out>) at hw/core/qdev.c:675
#6  0x00007f6796d0ea85 in get_boot_devices_list (size=size@entry=0x7fff70f27b80, ignore_suffixes=ignore_suffixes@entry=false) at vl.c:1295
#7  0x00007f6796da87b2 in fw_cfg_machine_ready (n=0x7f6798583328, data=<optimized out>) at hw/nvram/fw_cfg.c:506
#8  0x00007f6796e77c97 in notifier_list_notify (list=list@entry=0x7f6797310c50 <machine_init_done_notifiers>, data=data@entry=0x0) at util/notify.c:39
#9  0x00007f6796c08137 in qemu_run_machine_init_done_notifiers () at vl.c:2812
#10 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4567
(gdb)
Comment 4 Marcel Apfelbaum 2014-12-24 10:46:23 UTC 
Duplicate of 1176553, the sympotom is different but the problem is in the same method: qdev_get_fw_dev_path.

*** This bug has been marked as a duplicate of bug 1176553 ***