1368032 – kernel crash after hot remove virtio-gpu device

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1368032 - kernel crash after hot remove virtio-gpu device

Summary: kernel crash after hot remove virtio-gpu device

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	qemu-kvm-rhev
Sub Component:
Version:	7.3
Hardware:	x86_64
OS:	Linux
Priority:	unspecified
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	Gerd Hoffmann
QA Contact:	Guo, Zhiyi
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2016-08-18 07:41 UTC by Guo, Zhiyi
Modified:	2016-11-07 21:30 UTC (History)
CC List:	9 users (show)
Fixed In Version:	qemu-kvm-rhev-2.6.0-26.el7
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-11-07 21:30:56 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2016:2673	0	normal	SHIPPED_LIVE	qemu-kvm-rhev bug fix and enhancement update	2016-11-08 01:06:13 UTC

Description Guo, Zhiyi 2016-08-18 07:41:01 UTC

Description of problem:
kernel crash after hot remove virtio-gpu device

Version-Release number of selected component (if applicable):
qemu-kvm-rhev package:qemu-kvm-rhev-2.6.0-21.el7.x86_64
host & guest kernel:
3.10.0-489.el7.x86_64

How reproducible:
100% reproduce

Steps to Reproduce:
1.Boot rhel7.3 guest use qemu cli:
/usr/libexec/qemu-kvm -name rhel7.3 -m 2048 \
        -cpu Haswell-noTSX \
        -smp 6,threads=2,cores=1,sockets=3,maxcpus=6 \
	-device virtio-vga\
	-device virtio-gpu\
        -spice port=5901,disable-ticketing \
        -device virtio-serial -chardev spicevmc,id=vdagent,debug=0,name=vdagent \
        -serial unix:/tmp/m,server,nowait \
        -device virtserialport,chardev=vdagent,name=com.redhat.spice.0 \
        -drive file=rhel73.qcow2,if=none,id=drive-scsi-disk0,format=qcow2,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsi0,disable-modern=off,disable-legacy=off -device scsi-hd,drive=drive-scsi-disk0,bus=scsi0.0,scsi-id=0,lun=0,id=scsi-disk0,bootindex=1 \
        -monitor stdio \
        -usb -device usb-kbd,id=input0 \
        -netdev tap,id=idinWyYp -device virtio-net-pci,mac=42:ce:a9:d2:4d:d7,id=idlbq7eA,netdev=idinWyYp \
        -qmp tcp:localhost:4444,server,nowait \
	-device ich9-intel-hda -device hda-duplex \

2.Hot plug a new virtio-gpu into guest via qmp:
{ "execute": "device_add","arguments":{"driver":"virtio-gpu","id":"gpu1"}}
3.Hot remove this this virtio-gpu from guest:
{ "execute": "device_del","arguments":{"id":"gpu1"}}

Actual results:
kernel crash with log:
[   98.277860] ------------[ cut here ]------------
[   98.277894] WARNING: at drivers/gpu/drm/drm_mm.c:773 drm_mm_takedown+0x2e/0x30 [drm]()
[   98.277895] Memory manager not clean during takedown.
[   98.277897] Modules linked in: uinput xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun ipt_REJECT nf_reject_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter snd_hda_codec_generic snd_hda_intel snd_hda_codec virtio_gpu snd_hda_core snd_hwdep ttm snd_seq drm_kms_helper snd_seq_device syscopyarea snd_pcm sysfillrect iosf_mbi sysimgblt fb_sys_fops crc32_pclmul snd_timer ghash_clmulni_intel drm aesni_intel lrw gf128mul ppdev glue_helper snd soundcore
[   98.277933]  sg i2c_piix4 ablk_helper cryptd parport_pc parport i2c_core pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_generic ata_generic pata_acpi virtio_net virtio_scsi virtio_console crct10dif_pclmul crct10dif_common crc32c_intel ata_piix serio_raw virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
[   98.277964] CPU: 2 PID: 6 Comm: kworker/u12:0 Not tainted 3.10.0-493.el7.x86_64 #1
[   98.277966] Hardware name: Red Hat KVM, BIOS 1.9.1-4.el7 04/01/2014
[   98.277973] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[   98.277975]  ffff88007c073a18 00000000ea1e9a14 ffff88007c0739d0 ffffffff81683c5a
[   98.277978]  ffff88007c073a08 ffffffff810857c0 ffff8800584b04d8 ffff8800584b0078
[   98.277981]  ffff8800584b0098 ffff88003571f440 0000000000000000 ffff88007c073a70
[   98.277984] Call Trace:
[   98.277993]  [<ffffffff81683c5a>] dump_stack+0x19/0x1b
[   98.277997]  [<ffffffff810857c0>] warn_slowpath_common+0x70/0xb0
[   98.277999]  [<ffffffff8108585c>] warn_slowpath_fmt+0x5c/0x80
[   98.278012]  [<ffffffffa040ebbe>] drm_mm_takedown+0x2e/0x30 [drm]
[   98.278025]  [<ffffffffa042116b>] drm_vma_offset_manager_destroy+0x1b/0x30 [drm]
[   98.278033]  [<ffffffffa03e4b22>] ttm_bo_device_release+0xc2/0xf0 [ttm]
[   98.278039]  [<ffffffffa04b9fc6>] virtio_gpu_ttm_fini+0x16/0x50 [virtio_gpu]
[   98.278044]  [<ffffffffa04b57e5>] virtio_gpu_driver_unload+0x65/0xc0 [virtio_gpu]
[   98.278057]  [<ffffffffa040ab89>] drm_dev_unregister+0x29/0xb0 [drm]
[   98.278069]  [<ffffffffa040b273>] drm_put_dev+0x23/0x70 [drm]
[   98.278074]  [<ffffffffa04b5045>] virtio_gpu_remove+0x15/0x20 [virtio_gpu]
[   98.278081]  [<ffffffffa0024169>] virtio_dev_remove+0x49/0xd0 [virtio]
[   98.278088]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278090]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278108]  [<ffffffff8142bc58>] bus_remove_device+0x108/0x180
[   98.278114]  [<ffffffff81427d55>] device_del+0x135/0x200
[   98.278117]  [<ffffffff81427e3e>] device_unregister+0x1e/0x60
[   98.278124]  [<ffffffffa0024406>] unregister_virtio_device+0x16/0x30 [virtio]
[   98.278131]  [<ffffffffa005c5d4>] virtio_pci_remove+0x34/0x70 [virtio_pci]
[   98.278137]  [<ffffffff8135a9cb>] pci_device_remove+0x3b/0xb0
[   98.278141]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278144]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278148]  [<ffffffff81353ca4>] pci_stop_bus_device+0x94/0xa0
[   98.278151]  [<ffffffff81353d92>] pci_stop_and_remove_bus_device+0x12/0x20
[   98.278155]  [<ffffffff81371436>] disable_slot+0x76/0xd0
[   98.278159]  [<ffffffff813714ad>] acpiphp_disable_and_eject_slot+0x1d/0x80
[   98.278161]  [<ffffffff8137204d>] acpiphp_hotplug_notify+0x8d/0x210
[   98.278164]  [<ffffffff81371fc0>] ? acpiphp_post_dock_fixup+0xd0/0xd0
[   98.278168]  [<ffffffff81397421>] acpi_device_hotplug+0x3b5/0x418
[   98.278171]  [<ffffffff813907d5>] acpi_hotplug_work_fn+0x1e/0x29
[   98.278174]  [<ffffffff810a7e7b>] process_one_work+0x17b/0x470
[   98.278177]  [<ffffffff810a8cb6>] worker_thread+0x126/0x410
[   98.278179]  [<ffffffff810a8b90>] ? rescuer_thread+0x460/0x460
[   98.278183]  [<ffffffff810b046f>] kthread+0xcf/0xe0
[   98.278186]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278192]  [<ffffffff81694118>] ret_from_fork+0x58/0x90
[   98.278195]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278197] ---[ end trace 063a6ea66459d9fa ]---
[   98.278199] [drm] virtio_gpu: ttm finalized
[   98.278205] ------------[ cut here ]------------
[   98.278210] WARNING: at drivers/gpu/drm/virtio/virtgpu_vq.c:112 virtio_gpu_free_vbufs+0xb3/0xc0 [virtio_gpu]()
[   98.278211] Modules linked in: uinput xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun ipt_REJECT nf_reject_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter snd_hda_codec_generic snd_hda_intel snd_hda_codec virtio_gpu snd_hda_core snd_hwdep ttm snd_seq drm_kms_helper snd_seq_device syscopyarea snd_pcm sysfillrect iosf_mbi sysimgblt fb_sys_fops crc32_pclmul snd_timer ghash_clmulni_intel drm aesni_intel lrw gf128mul ppdev glue_helper snd soundcore
[   98.278245]  sg i2c_piix4 ablk_helper cryptd parport_pc parport i2c_core pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_generic ata_generic pata_acpi virtio_net virtio_scsi virtio_console crct10dif_pclmul crct10dif_common crc32c_intel ata_piix serio_raw virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
[   98.278268] CPU: 2 PID: 6 Comm: kworker/u12:0 Tainted: G        W      ------------   3.10.0-493.el7.x86_64 #1
[   98.278269] Hardware name: Red Hat KVM, BIOS 1.9.1-4.el7 04/01/2014
[   98.278272] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[   98.278274]  0000000000000000 00000000ea1e9a14 ffff88007c073a68 ffffffff81683c5a
[   98.278277]  ffff88007c073aa0 ffffffff810857c0 000000000000004e ffff8800584b0000
[   98.278319]  0000000000000050 ffff8800584b8bd8 ffff8800584b8be8 ffff88007c073ab0
[   98.278322] Call Trace:
[   98.278327]  [<ffffffff81683c5a>] dump_stack+0x19/0x1b
[   98.278330]  [<ffffffff810857c0>] warn_slowpath_common+0x70/0xb0
[   98.278332]  [<ffffffff8108590a>] warn_slowpath_null+0x1a/0x20
[   98.278339]  [<ffffffffa04b8333>] virtio_gpu_free_vbufs+0xb3/0xc0 [virtio_gpu]
[   98.278343]  [<ffffffffa04b57ed>] virtio_gpu_driver_unload+0x6d/0xc0 [virtio_gpu]
[   98.278356]  [<ffffffffa040ab89>] drm_dev_unregister+0x29/0xb0 [drm]
[   98.278367]  [<ffffffffa040b273>] drm_put_dev+0x23/0x70 [drm]
[   98.278373]  [<ffffffffa04b5045>] virtio_gpu_remove+0x15/0x20 [virtio_gpu]
[   98.278380]  [<ffffffffa0024169>] virtio_dev_remove+0x49/0xd0 [virtio]
[   98.278386]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278388]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278390]  [<ffffffff8142bc58>] bus_remove_device+0x108/0x180
[   98.278394]  [<ffffffff81427d55>] device_del+0x135/0x200
[   98.278397]  [<ffffffff81427e3e>] device_unregister+0x1e/0x60
[   98.278403]  [<ffffffffa0024406>] unregister_virtio_device+0x16/0x30 [virtio]
[   98.278409]  [<ffffffffa005c5d4>] virtio_pci_remove+0x34/0x70 [virtio_pci]
[   98.278414]  [<ffffffff8135a9cb>] pci_device_remove+0x3b/0xb0
[   98.278418]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278420]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278423]  [<ffffffff81353ca4>] pci_stop_bus_device+0x94/0xa0
[   98.278426]  [<ffffffff81353d92>] pci_stop_and_remove_bus_device+0x12/0x20
[   98.278429]  [<ffffffff81371436>] disable_slot+0x76/0xd0
[   98.278433]  [<ffffffff813714ad>] acpiphp_disable_and_eject_slot+0x1d/0x80
[   98.278435]  [<ffffffff8137204d>] acpiphp_hotplug_notify+0x8d/0x210
[   98.278437]  [<ffffffff81371fc0>] ? acpiphp_post_dock_fixup+0xd0/0xd0
[   98.278441]  [<ffffffff81397421>] acpi_device_hotplug+0x3b5/0x418
[   98.278444]  [<ffffffff813907d5>] acpi_hotplug_work_fn+0x1e/0x29
[   98.278446]  [<ffffffff810a7e7b>] process_one_work+0x17b/0x470
[   98.278449]  [<ffffffff810a8cb6>] worker_thread+0x126/0x410
[   98.278451]  [<ffffffff810a8b90>] ? rescuer_thread+0x460/0x460
[   98.278454]  [<ffffffff810b046f>] kthread+0xcf/0xe0
[   98.278457]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278460]  [<ffffffff81694118>] ret_from_fork+0x58/0x90
[   98.278463]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278465] ---[ end trace 063a6ea66459d9fb ]---
[   98.278481] ------------[ cut here ]------------
[   98.278484] kernel BUG at mm/slub.c:3602!
[   98.278486] invalid opcode: 0000 [#1] SMP 
[   98.278488] Modules linked in: uinput xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun ipt_REJECT nf_reject_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter snd_hda_codec_generic snd_hda_intel snd_hda_codec virtio_gpu snd_hda_core snd_hwdep ttm snd_seq drm_kms_helper snd_seq_device syscopyarea snd_pcm sysfillrect iosf_mbi sysimgblt fb_sys_fops crc32_pclmul snd_timer ghash_clmulni_intel drm aesni_intel lrw gf128mul ppdev glue_helper snd soundcore
[   98.278525]  sg i2c_piix4 ablk_helper cryptd parport_pc parport i2c_core pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_generic ata_generic pata_acpi virtio_net virtio_scsi virtio_console crct10dif_pclmul crct10dif_common crc32c_intel ata_piix serio_raw virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
[   98.278549] CPU: 2 PID: 6 Comm: kworker/u12:0 Tainted: G        W      ------------   3.10.0-493.el7.x86_64 #1
[   98.278551] Hardware name: Red Hat KVM, BIOS 1.9.1-4.el7 04/01/2014
[   98.278554] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[   98.278556] task: ffff88007c7bce70 ti: ffff88007c070000 task.ti: ffff88007c070000
[   98.278557] RIP: 0010:[<ffffffff811dc6a9>]  [<ffffffff811dc6a9>] kfree+0x139/0x140
[   98.278564] RSP: 0018:ffff88007c073ad0  EFLAGS: 00010246
[   98.278565] RAX: 001fffff00000000 RBX: ffff8800584b0000 RCX: 0000000000000006
[   98.278567] RDX: 001fffff00000000 RSI: 0000000000000000 RDI: ffff8800584b0000
[   98.278568] RBP: ffff88007c073ae8 R08: 0000000000000086 R09: 00000000000002bb
[   98.278570] R10: 0000000000000000 R11: ffffea0001612c00 R12: ffff8800584b8cd8
[   98.278571] R13: ffffffffa04b5834 R14: ffff8800584b8cd8 R15: ffff88007c76e6e0
[   98.278573] FS:  0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
[   98.278575] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   98.278576] CR2: 00007fc265ac8000 CR3: 0000000079116000 CR4: 00000000001406e0
[   98.278581] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   98.278583] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   98.278584] Stack:
[   98.278585]  ffff8800584b8cd8 ffff8800584b8cd8 ffff8800584b0000 ffff88007c073b18
[   98.278588]  ffffffffa04b5834 ffff8800792a7000 ffff8800792a7000 ffff88000006d808
[   98.278591]  ffffffffa04bf000 ffff88007c073b40 ffffffffa040ab89 ffff8800792a7000
[   98.278594] Call Trace:
[   98.278599]  [<ffffffffa04b5834>] virtio_gpu_driver_unload+0xb4/0xc0 [virtio_gpu]
[   98.278610]  [<ffffffffa040ab89>] drm_dev_unregister+0x29/0xb0 [drm]
[   98.278620]  [<ffffffffa040b273>] drm_put_dev+0x23/0x70 [drm]
[   98.278624]  [<ffffffffa04b5045>] virtio_gpu_remove+0x15/0x20 [virtio_gpu]
[   98.278630]  [<ffffffffa0024169>] virtio_dev_remove+0x49/0xd0 [virtio]
[   98.278636]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278639]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278642]  [<ffffffff8142bc58>] bus_remove_device+0x108/0x180
[   98.278645]  [<ffffffff81427d55>] device_del+0x135/0x200
[   98.278648]  [<ffffffff81427e3e>] device_unregister+0x1e/0x60
[   98.278654]  [<ffffffffa0024406>] unregister_virtio_device+0x16/0x30 [virtio]
[   98.278661]  [<ffffffffa005c5d4>] virtio_pci_remove+0x34/0x70 [virtio_pci]
[   98.278666]  [<ffffffff8135a9cb>] pci_device_remove+0x3b/0xb0
[   98.278670]  [<ffffffff8142c44f>] __device_release_driver+0x7f/0xf0
[   98.278672]  [<ffffffff8142c4e3>] device_release_driver+0x23/0x30
[   98.278675]  [<ffffffff81353ca4>] pci_stop_bus_device+0x94/0xa0
[   98.278680]  [<ffffffff81353d92>] pci_stop_and_remove_bus_device+0x12/0x20
[   98.278684]  [<ffffffff81371436>] disable_slot+0x76/0xd0
[   98.278687]  [<ffffffff813714ad>] acpiphp_disable_and_eject_slot+0x1d/0x80
[   98.278690]  [<ffffffff8137204d>] acpiphp_hotplug_notify+0x8d/0x210
[   98.278692]  [<ffffffff81371fc0>] ? acpiphp_post_dock_fixup+0xd0/0xd0
[   98.278695]  [<ffffffff81397421>] acpi_device_hotplug+0x3b5/0x418
[   98.278698]  [<ffffffff813907d5>] acpi_hotplug_work_fn+0x1e/0x29
[   98.278700]  [<ffffffff810a7e7b>] process_one_work+0x17b/0x470
[   98.278703]  [<ffffffff810a8cb6>] worker_thread+0x126/0x410
[   98.278705]  [<ffffffff810a8b90>] ? rescuer_thread+0x460/0x460
[   98.278708]  [<ffffffff810b046f>] kthread+0xcf/0xe0
[   98.278711]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278714]  [<ffffffff81694118>] ret_from_fork+0x58/0x90
[   98.278717]  [<ffffffff810b03a0>] ? kthread_create_on_node+0x140/0x140
[   98.278719] Code: 49 8b 03 31 f6 f6 c4 40 74 04 41 8b 73 68 4c 89 df e8 3c ce fa ff eb 89 4c 8b 58 30 48 8b 10 80 e6 80 4c 0f 44 d8 e9 2c ff ff ff <0f> 0b 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 ff 
[   98.278752] RIP  [<ffffffff811dc6a9>] kfree+0x139/0x140
[   98.278755]  RSP <ffff88007c073ad0>

Expected results:
No kernel crash happen

Additional info:
Test on windows 10, hot remove won't cause windows crash
Attach log generated from abrt

Comment 2 Gerd Hoffmann 2016-09-13 07:23:20 UTC

virtio-gpu-pcui is not hotpluggable.
https://patchwork.ozlabs.org/patch/667325/

Comment 3 Gerd Hoffmann 2016-09-14 09:28:09 UTC

> https://patchwork.ozlabs.org/patch/667325/
backport posted.

Comment 4 Miroslav Rezanina 2016-09-20 12:29:42 UTC

Fix included in qemu-kvm-rhev-2.6.0-26.el7

Comment 6 Guo, Zhiyi 2016-09-22 02:48:46 UTC

Verify against qemu-kvm-rhev-2.6.0-26.el7.x86_64.

qemu cli used:
/usr/libexec/qemu-kvm -name rhel7.3 -m 2048 \
        -smp 6,threads=2,cores=1,sockets=3,maxcpus=6 \
        -cpu Haswell-noTSX,check \
	-device virtio-vga \
	-device virtio-gpu,id=virtgpu \
        -spice port=3001,disable-ticketing \
        -device virtio-serial -chardev spicevmc,id=vdagent,debug=0,name=vdagent \
        -serial unix:/tmp/m,server,nowait \
        -device virtserialport,chardev=vdagent,name=com.redhat.spice.0 \
        -drive file=/home/guest/rhel73ss4.qcow2,if=none,id=drive-scsi-disk0,format=qcow2,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsi0 -device scsi-hd,drive=drive-scsi-disk0,bus=scsi0.0,scsi-id=0,lun=0,id=scsi-disk0,bootindex=1 \
        -monitor stdio \
        -usb -device usb-kbd,id=input0 \
        -netdev tap,id=idinWyYp,vhost=on -device virtio-net-pci,mac=42:ce:a9:d2:4d:d7,id=idlbq7eA,netdev=idinWyYp \
        -qmp tcp:localhost:4444,server,nowait \
        -device intel-hda,id=sound0 -device hda-duplex,id=sound0-codec0

Boot guest and try to hot remove virtio-gpu device, qmp prompt not support hotplugging:
{ "execute": "device_del","arguments":{"id":"virtgpu"}}
{"error": {"class": "GenericError", "desc": "Device 'virtio-gpu-pci' does not support hotplugging"}}

Try to hot plug virtio-gpu device, qmp prompt device not hotplugable:
{ "execute": "device_add","arguments":{"driver":"virtio-gpu","id":"gpu1"}}
{"error": {"class": "GenericError", "desc": "Parameter 'driver' expects pluggable device type"}}

Comment 7 Guo, Zhiyi 2016-09-22 02:50:29 UTC

Per comment 6, move to verified

Comment 9 errata-xmlrpc 2016-11-07 21:30:56 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2673.html

Note You need to log in before you can comment on or make changes to this bug.