Bug 1367029

Created attachment 1190845 [details]
Guest xml

Created attachment 1190846 [details]
The full backtrace of coredump

spice worker thread crashing, reassigning to spice.

Hi,

what is purpose of the configuration (multiple devices and multiple heads) ?

(In reply to JinFangge from comment #0)
> # virsh dumpxml rhel7
> ...
>     <video>
>       <model type='qxl' ram='1' vram='32768' vgamem='16384' heads='2'
> primary='yes'/>
>       <address type='pci' domain='0x0000' bus='0x00' slot='0x09'
> function='0x0'/>
>     </video>
>     <video>
>       <model type='qxl' ram='65536' vram='65536' vgamem='16384' heads='3'/>
>       <address type='pci' domain='0x0000' bus='0x00' slot='0x06'
> function='0x0'/>
>     </video>
>     <video>
>       <model type='qxl' ram='65536' vram='16384' vgamem='16384' heads='1'/>
>       <address type='pci' domain='0x0000' bus='0x00' slot='0x02'
> function='0x0'/>
>     </video>
>

the assertion is removed in the commit 5c7e248445f95c3fa2627532780950cf604b9e20

https://cgit.freedesktop.org/spice/spice/commit/?id=5c7e248445f95c3fa2627532780950cf604b9e20

(In reply to Pavel Grunt from comment #5)
> Hi,
> 
> what is purpose of the configuration (multiple devices and multiple heads) ?
> 
> (In reply to JinFangge from comment #0)
> > # virsh dumpxml rhel7
> > ...
> >     <video>
> >       <model type='qxl' ram='1' vram='32768' vgamem='16384' heads='2'
> > primary='yes'/>
> >       <address type='pci' domain='0x0000' bus='0x00' slot='0x09'
> > function='0x0'/>
> >     </video>
> >     <video>
> >       <model type='qxl' ram='65536' vram='65536' vgamem='16384' heads='3'/>
> >       <address type='pci' domain='0x0000' bus='0x00' slot='0x06'
> > function='0x0'/>
> >     </video>
> >     <video>
> >       <model type='qxl' ram='65536' vram='16384' vgamem='16384' heads='1'/>
> >       <address type='pci' domain='0x0000' bus='0x00' slot='0x02'
> > function='0x0'/>
> >     </video>
> >

It's just for testing, and "heads" doesn't take effect for now actually.

Incorrect setting - there is only one driver for rhel 7 VMs. Need to investigate to be sure the only incorrect setting causes the crash.

A "minimal" reproducer is to just add an additional
<video><model type='qxl'/></video> node to an existing RHEL7 VM, and then use virsh reboot. The specifics of the <video> XML nodes did not make a difference here for reproduction.

Pavel, should we backport the patch?

(In reply to Frediano Ziglio from comment #10)
> Pavel, should we backport the patch?

Yes. It is in the upstream stable branch as well - ie it can be consider fixed by resolving the bug 1388947

On CentOS we're seeing a similar bug:

https://bugs.centos.org/view.php?id=12666

but that's got the following calling stack:

 {   "crash_thread": true
        ,   "frames":
              [ {   "address": 140542346469847
                ,   "build_id": "8b2c421716985b927aa0caf2a05d0b1f452367f7"
                ,   "build_id_offset": 217559
                ,   "function_name": "raise"
                ,   "file_name": "/lib64/libc.so.6"
                }
              , {   "address": 140542346475720
                ,   "build_id": "8b2c421716985b927aa0caf2a05d0b1f452367f7"
                ,   "build_id_offset": 223432
                ,   "function_name": "abort"
                ,   "file_name": "/lib64/libc.so.6"
                }
              , {   "address": 140542360880444
                ,   "build_id": "279f86639ce10689c4b461a2a2075f01480dc8b1"
                ,   "build_id_offset": 423228
                ,   "function_name": "spice_logv"
                ,   "file_name": "/lib64/libspice-server.so.1"
                }
              , {   "address": 140542360880789
                ,   "build_id": "279f86639ce10689c4b461a2a2075f01480dc8b1"
                ,   "build_id_offset": 423573
                ,   "function_name": "spice_log"
                ,   "file_name": "/lib64/libspice-server.so.1"
                }
              , {   "address": 140542360695117
                ,   "build_id": "279f86639ce10689c4b461a2a2075f01480dc8b1"
                ,   "build_id_offset": 237901
                ,   "function_name": "free_one_drawable"
                ,   "file_name": "/lib64/libspice-server.so.1"
                }
              , {   "address": 140542360702846
                ,   "build_id": "279f86639ce10689c4b461a2a2075f01480dc8b1"
                ,   "build_id_offset": 245630
                ,   "function_name": "red_process_commands.constprop.139"
                ,   "file_name": "/lib64/libspice-server.so.1"
                }
              , {   "address": 140542360745610
                ,   "build_id": "279f86639ce10689c4b461a2a2075f01480dc8b1"
                ,   "build_id_offset": 288394
                ,   "function_name": "red_worker_main"
                ,   "file_name": "/lib64/libspice-server.so.1"
                }
              , {   "address": 140542473665989
                ,   "build_id": "c3deb1fa27cd0c1c3cc575b944abacba0698b0f2"
                ,   "build_id_offset": 32197
                ,   "function_name": "start_thread"
                ,   "file_name": "/lib64/libpthread.so.0"
                }
              , {   "address": 140542347265853
                ,   "build_id": "8b2c421716985b927aa0caf2a05d0b1f452367f7"
                ,   "build_id_offset": 1013565
                ,   "function_name": "__clone"
                ,   "file_name": "/lib64/libc.so.6"
                } ]
        }

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1866