Bug 1296415 - Unhotplug glusterfs drive then shutdown rhel 7.2 guest will cause qemu coredump.
Unhotplug glusterfs drive then shutdown rhel 7.2 guest will cause qemu coredump.
Status: NEW
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
6.8
x86_64 Linux
unspecified Severity high
: rc
: ---
Assigned To: Jeff Cody
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-07 03:29 EST by Guo, Zhiyi
Modified: 2017-03-23 15:55 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Guo, Zhiyi 2016-01-07 03:29:07 EST
Description of problem:
Unhotplug glusterfs drive then shutdown rhel 7.2 guest will cause qemu coredump.

Version-Release number of selected component (if applicable):
kernel:2.6.32-595.el6.x86_64
qemu:qemu-kvm-0.12.1.2-2.482.el6.x86_64
glusterfs:
glusterfs-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-api-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-api-devel-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-cli-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-client-xlators-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-debuginfo-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-devel-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-fuse-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-geo-replication-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-libs-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-rdma-3.7.5-13.el6rhs.x86_64.rpm
glusterfs-server-3.7.5-13.el6rhs.x86_64.rpm
pyxattr-0.5.1-5.el6eng.x86_64.rpm
userspace-rcu-0.7.9-2.el6rhs.x86_64.rpm
How reproducible:


Steps to Reproduce:
1.boot guest with cmd:
/usr/libexec/qemu-kvm -name rhel7.2 -m 4G \
        -smp 4 \
        -cpu SandyBridge,check \
         -vga qxl\
        -spice port=3001,disable-ticketing \
        -device virtio-serial -chardev spicevmc,id=vdagent,debug=0,name=vdagent \
        -serial unix:/tmp/m,server,nowait \
        -device virtserialport,chardev=vdagent,name=com.redhat.spice.0 \
        -drive file=gluster://10.66.10.61/mygluster/30Ggluster.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,werror=stop,rerror=stop,aio=threads\
        -device virtio-blk-pci,bus=pci.0,drive=drive-virtio-disk0,scsi=off,id=drive-virtio-disk0\
        -drive file=gluster://10.66.10.61/mygluster/data.qcow2,if=none,id=drive-virtio-disk1,format=qcow2,cache=none,werror=stop,rerror=stop,aio=threads\
        -device virtio-blk-pci,drive=drive-virtio-disk1,scsi=off,id=drive-virtio-disk1\
        -monitor stdio \
        -netdev tap,id=idinWyYp,vhost=on -device virtio-net-pci,mac=42:ce:a9:d2:4d:d7,id=idlbq7eA,netdev=idinWyYp \
        -usb -device usb-kbd,id=input0 \
2.hot unplug data disk by: device_del drive-virtio-disk1 and then shutdown the rhel 7.2 guest
3.

Actual results:
core dump:
*** glibc detected *** /usr/libexec/qemu-kvm: free(): invalid pointer: 0x00007f6558b6bcd0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x3cda475f4e)[0x7f65536e2f4e]
/lib64/libc.so.6(+0x3cda478c5d)[0x7f65536e5c5d]
/usr/lib64/libglusterfs.so.0(gf_timer_proc+0x1c9)[0x7f6552fdf5d9]
/lib64/libpthread.so.0(+0x3cdac07a51)[0x7f655675da51]
/lib64/libc.so.6(clone+0x6d)[0x7f655375596d]
======= Memory map: ========
7f63d0000000-7f63d0021000 rw-p 00000000 00:00 0 
7f63d0021000-7f63d4000000 ---p 00000000 00:00 0 
7f63d8000000-7f63d8021000 rw-p 00000000 00:00 0 
7f63d8021000-7f63dc000000 ---p 00000000 00:00 0 
7f63dc000000-7f63dc021000 rw-p 00000000 00:00 0 
7f63dc021000-7f63e0000000 ---p 00000000 00:00 0 
7f63e0000000-7f63e0021000 rw-p 00000000 00:00 0 
7f63e0021000-7f63e4000000 ---p 00000000 00:00 0 
7f63e4000000-7f63e4021000 rw-p 00000000 00:00 0 
7f63e4021000-7f63e8000000 ---p 00000000 00:00 0 
7f63e8000000-7f63e8021000 rw-p 00000000 00:00 0 
7f63e8021000-7f63ec000000 ---p 00000000 00:00 0 
7f63ec000000-7f63ec021000 rw-p 00000000 00:00 0 
7f63ec021000-7f63f0000000 ---p 00000000 00:00 0 
7f63f0000000-7f63f0021000 rw-p 00000000 00:00 0 
7f63f0021000-7f63f4000000 ---p 00000000 00:00 0 
7f63f4000000-7f63f4021000 rw-p 00000000 00:00 0 
7f63f4021000-7f63f8000000 ---p 00000000 00:00 0 
7f63f8000000-7f63f91f4000 rw-p 00000000 00:00 0 
7f63f91f4000-7f63fc000000 ---p 00000000 00:00 0 
7f63ff8f4000-7f63ff9fd000 rw-p 00000000 00:00 0 
7f63ff9fd000-7f63ffa00000 rw-p 00000000 00:00 0 
7f63ffa00000-7f6403a00000 rw-p 00000000 00:00 0 
7f6403a00000-7f6403c00000 rw-p 00000000 00:00 0 
7f6403c00000-7f6407c00000 rw-p 00000000 00:00 0 
7f6407c00000-7f6407e00000 rw-p 00000000 00:00 0 
7f6407e00000-7f6507e00000 rw-p 00000000 00:00 0 
7f6507e00000-7f6508000000 rw-p 00000000 00:00 0 
7f6508000000-7f6508021000 rw-p 00000000 00:00 0 
7f6508021000-7f650c000000 ---p 00000000 00:00 0 
7f650c7b4000-7f650c7b5000 ---p 00000000 00:00 0 
7f650c7b5000-7f650d1b5000 rw-p 00000000 00:00 0 
7f650d1b5000-7f650d1b6000 ---p 00000000 00:00 0 
7f650d1b6000-7f650dbb6000 rw-p 00000000 00:00 0 
7f650dbb6000-7f650dbb7000 ---p 00000000 00:00 0 
7f650dbb7000-7f650e9b7000 rw-p 00000000 00:00 0 
7f650ead1000-7f650ebfe000 rw-p 00000000 00:00 0 
7f650ebfe000-7f650ebff000 ---p 00000000 00:00 0 
7f650ebff000-7f650f5ff000 rw-p 00000000 00:00 0 
7f650f5ff000-7f650f600000 ---p 00000000 00:00 0 
7f650f600000-7f6510000000 rw-p 00000000 00:00 0 
7f6510000000-7f6510053000 rw-p 00000000 00:00 0 
7f6510053000-7f6514000000 ---p 00000000 00:00 0 
7f6514000000-7f6514021000 rw-p 00000000 00:00 0 
7f6514021000-7f6518000000 ---p 00000000 00:00 0 
7f6518000000-7f651825e000 rw-p 00000000 00:00 0 
7f651825e000-7f651c000000 ---p 00000000 00:00 0 
7f651c0b9000-7f651c1d3000 rw-p 00000000 00:00 0 
7f651c2eb000-7f651c2ec000 ---p 00000000 00:00 0 
7f651c2ec000-7f651ccec000 rw-p 00000000 00:00 0 
7f651ccec000-7f651cced000 ---p 00000000 00:00 0 
7f651cced000-7f651d6ed000 rw-p 00000000 00:00 0 
7f651d6ed000-7f651d6ee000 ---p 00000000 00:00 0 
7f651d6ee000-7f651e0ee000 rw-p 00000000 00:00 0 
7f651e0ee000-7f651e0fa000 r-xp 00000000 fd:00 2887994                    /usr/lib64/sasl2/libdigestmd5.so.2.0.23
7f651e0fa000-7f651e2f9000 ---p 0000c000 fd:00 2887994                    /usr/lib64/sasl2/libdigestmd5.so.2.0.23
7f651e2f9000-7f651e2fa000 r--p 0000b000 fd:00 2887994                    /usr/lib64/sasl2/libdigestmd5.so.2.0.23
7f651e2fa000-7f651e2fb000 rw-p 0000c000 fd:00 2887994                    /usr/lib64/sasl2/libdigestmd5.so.2.0.23
7f651e2fb000-7f651e2ff000 r-xp 00000000 fd:00 2887991                    /usr/lib64/sasl2/libcrammd5.so.2.0.23
7f651e2ff000-7f651e4ff000 ---p 00004000 fd:00 2887991                    /usr/lib64/sasl2/libcrammd5.so.2.0.23
7f651e4ff000-7f651e500000 r--p 00004000 fd:00 2887991                    /usr/lib64/sasl2/libcrammd5.so.2.0.23
7f651e500000-7f651e501000 rw-p 00005000 fd:00 2887991                    /usr/lib64/sasl2/libcrammd5.so.2.0.23
7f651e501000-7f651e505000 r-xp 00000000 fd:00 2885031                    /usr/lib64/sasl2/libanonymous.so.2.0.23
7f651e505000-7f651e704000 ---p 00004000 fd:00 2885031                    /usr/lib64/sasl2/libanonymous.so.2.0.23
7f651e704000-7f651e705000 r--p 00003000 fd:00 2885031                    /usr/lib64/sasl2/libanonymous.so.2.0.23
7f651e705000-7f651e706000 rw-p 00004000 fd:00 2885031                    /usr/lib64/sasl2/libanonymous.so.2.0.23
7f651e706000-7f651e70a000 r-xp 00000000 fd:00 2894755                    /usr/lib64/sasl2/libplain.so.2.0.23
7f651e70a000-7f651e909000 ---p 00004000 fd:00 2894755                    /usr/lib64/sasl2/libplain.so.2.0.23
7f651e909000-7f651e90a000 r--p 00003000 fd:00 2894755                    /usr/lib64/sasl2/libplain.so.2.0.23
7f651e90a000-7f651e90b000 rw-p 00004000 fd:00 2894755                    /usr/lib64/sasl2/libplain.so.2.0.23
7f651e90b000-7f651ea7a000 r-xp 00000000 fd:00 1966166                    /lib64/libdb-4.7.so
7f651ea7a000-7f651ec79000 ---p 0016f000 fd:00 1966166                    /lib64/libdb-4.7.so
7f651ec79000-7f651ec7f000 rw-p 0016e000 fd:00 1966166                    /lib64/libdb-4.7.so
7f6520000000-7f652006e000 rw-p 00000000 00:00 0 
7f652006e000-7f6524000000 ---p 00000000 00:00 0 
7f6524000000-7f6524021000 rw-p 00000000 00:00 0 
7f6524021000-7f6528000000 ---p 00000000 00:00 0 
7f6528000000-7f6528021000 rw-p 00000000 00:00 0 
7f6528021000-7f652c000000 ---p 00000000 00:00 0 
7f652c041000-7f652c042000 rw-p 00000000 00:00 0 
7f652c042000-7f652c062000 rw-p 00000000 00:00 0 
7f652c062000-7f652c063000 rw-p 00000000 00:00 0 
7f652c0e0000-7f652c164000 rw-p 00000000 00:00 0 
7f652e0e8000-7f652e0e9000 ---p 00000000 00:00 0 
7f652e0e9000-7f652eae9000 rw-p 00000000 00:00 0 
7f652eaea000-7f652eaeb000 ---p 00000000 00:00 0 
7f652eaeb000-7f652f4ec000 rw-p 00000000 00:00 0 
7f652fd62000-7f652fd63000 ---p 00000000 00:00 0 
7f652fd63000-7f6530763000 rw-p 00000000 00:00 0 
7f6530763000-7f6530764000 ---p 00000000 00:00 0 
7f6530764000-7f6531164000 rw-p 00000000 00:00 0 
7f6531fc5000-7f65320c6000 rw-p 00000000 00:00 0 
7f6534000000-7f6534078000 rw-p 00000000 00:00 0 
7f6534078000-7f6538000000 ---p 00000000 00:00 0 
7f6538000000-7f6538021000 rw-p 00000000 00:00 0 
7f6538021000-7f653c000000 ---p 00000000 00:00 0 
7f653c000000-7f653c021000 rw-p 00000000 00:00 0 
7f653c021000-7f6540000000 ---p 00000000 00:00 0 
7f654000a000-7f654002c000 rw-p 00000000 00:00 0 
7f654002c000-7f654004c000 rw-p 00000000 00:00 0 
7f654004c000-7f654004d000 rw-p 00000000 00:00 0 
7f654004d000-7f6540051000 r-xp 00000000 fd:00 2894752                    /usr/lib64/sasl2/liblogin.so.2.0.23
7f6540051000-7f6540250000 ---p 00004000 fd:00 2894752                    /usr/lib64/sasl2/liblogin.so.2.0.23
7f6540250000-7f6540251000 r--p 00003000 fd:00 2894752                    /usr/lib64/sasl2/liblogin.so.2.0.23
7f6540251000-7f6540252000 rw-p 00004000 fd:00 2894752                    /usr/lib64/sasl2/liblogin.so.2.0.23
7f6540252000-7f6540257000 r-xp 00000000 fd:00 2885034                    /usr/lib64/sasl2/libsasldb.so.2.0.23
7f6540257000-7f6540456000 ---p 00005000 fd:00 2885034                    /usr/lib64/sasl2/libsasldb.so.2.0.23Aborted (core dumped)

gdb backtrace:
#0  0x00007f8ca9333625 in raise () from /lib64/libc.so.6
#1  0x00007f8ca9334e05 in abort () from /lib64/libc.so.6
#2  0x00007f8ca9371537 in __libc_message () from /lib64/libc.so.6
#3  0x00007f8ca9376f4e in malloc_printerr () from /lib64/libc.so.6
#4  0x00007f8ca9379c5d in _int_free () from /lib64/libc.so.6
#5  0x00007f8ca8c735d9 in gf_timer_proc (ctx=0x7f8cad5da5f0) at timer.c:227
#6  0x00007f8cac3f1a51 in start_thread () from /lib64/libpthread.so.0
#7  0x00007f8ca93e996d in clone () from /lib64/libc.so.6

Expected results:
No core dump happen.

Additional info:
No such issue happen when drive is a normal local qcow2 image.

Note You need to log in before you can comment on or make changes to this bug.