RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1788757 - assertion `ccc != NULL' failed when repeated migration and killing remote-viewer
Summary: assertion `ccc != NULL' failed when repeated migration and killing remote-viewer
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: spice
Version: 8.2
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: rc
: 8.0
Assignee: Frediano Ziglio
QA Contact: SPICE QE bug list
URL:
Whiteboard:
Depends On: 1840240
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-01-08 02:22 UTC by Han Han
Modified: 2020-11-04 04:07 UTC (History)
11 users (show)

Fixed In Version: spice-0.14.3-2.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-04 04:07:31 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
attachment for additional info (17.65 KB, application/gzip)
2020-01-08 02:22 UTC, Han Han 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2020:4818 0 None None None 2020-11-04 04:07:52 UTC

Description Han Han 2020-01-08 02:22:05 UTC 
Created attachment 1650565 [details]
attachment for additional info

Description of problem:
As subject

Version-Release number of selected component (if applicable):
Host:
qemu-kvm-4.2.0-4.el8.bz1786413a.x86_64
spice-server-0.14.2-1.el8.x86_64
libvirt-5.10.0-1.module+el8.2.0+5135+ed3b2489.x86_64

Desktop:
virt-viewer-7.0-9.el8.x86_64

How reproducible:
1% for once migration


Steps to Reproduce:
1. Create an VM
2. Migrate it to another L1 host, then migrate it back, in loops
3. Try to connect spice console via remote-viewer, then after a random seconds, disconnect, then connect again, in loops

Actual results:
Qemu logs from source migration host:
char device redirected to /dev/pts/0 (label charserial0)
2020-01-08T01:24:47.007947Z qemu-kvm: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12]                                   
2020-01-08T01:24:47.008007Z qemu-kvm: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13]                                  
2020-01-08T01:24:47.009211Z qemu-kvm: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12]                                   
2020-01-08T01:24:47.009222Z qemu-kvm: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13]                                  
2020-01-08 01:24:49.152+0000: initiating migration
2020-01-08 01:24:49.786+0000: shutting down, reason=migrated

Qemu logs from destination migration host:
2020-01-08T01:41:36.413626Z qemu-kvm: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12]
2020-01-08T01:41:36.413683Z qemu-kvm: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13]
2020-01-08T01:41:36.415025Z qemu-kvm: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12]
2020-01-08T01:41:36.415040Z qemu-kvm: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13]
2020-01-08T01:41:36.895529Z qemu-kvm: warning: Spice: Connection reset by peer
2020-01-08T01:41:36.895558Z qemu-kvm: warning: Spice: Connection reset by peer
2020-01-08T01:41:36.896507Z qemu-kvm: warning: Spice: cursor:0 (0x55ec3cfec940): Failed to create channel client: Client 0x55ec3cfe91d0 got disconnected while connecting ch
annel type 4 id 0
2020-01-08T01:41:36.896541Z qemu-kvm: Spice: cursor-channel.c:353:cursor_channel_connect: condition `ccc != NULL' failed
2020-01-08 01:41:38.126+0000: shutting down, reason=crashed


Get coredumps when migration:
Wed 2020-01-08 09:41:37 CST   14625   107   107  31 present   /usr/libexec/qemu-kvm
Wed 2020-01-08 09:41:37 CST   14614   107   107   6 present   /usr/libexec/qemu-kvm

Coredump backtrace of signal 31:
#0  0x00007f31d5dd153b in execve () at ../sysdeps/unix/syscall-template.S:78
#1  0x00007f31d5dd1855 in __GI_execle (path=path@entry=0x7f31d8045ea8 "/usr/bin/gstack", arg=arg@entry=0x7f31d8045eb1 "gstack") at execle.c:57
#2  0x00007f31d7fc350d in spice_backtrace_gstack () at backtrace.c:86
#3  0x00007f31d7fc3551 in spice_backtrace () at backtrace.c:129
#4  0x00007f31d7fca943 in spice_logv (log_domain=0x7f31d8031cb1 "Spice", args=0x7f31c69fe410, format=0x7f31d8032c75 "condition `%s' failed", 
    function=0x7f31d8032fc0 <__FUNCTION__.47260> "cursor_channel_connect", strloc=0x7f31d8032cff "cursor-channel.c:353", log_level=G_LOG_LEVEL_CRITICAL, 
    log_domain=0x7f31d8031cb1 "Spice") at log.c:57
#5  spice_log (log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, strloc=strloc@entry=0x7f31d8032cff "cursor-channel.c:353", 
    function=function@entry=0x7f31d8032fc0 <__FUNCTION__.47260> "cursor_channel_connect", format=format@entry=0x7f31d8032c75 "condition `%s' failed") at log.c:71
#6  0x00007f31d7f6dcf8 in cursor_channel_connect (cursor=0x55ec3cfec940, client=<optimized out>, stream=0x55ec3e3c8ae0, migrate=1, caps=0x55ec3e3f3e88)
    at cursor-channel.c:353
#7  0x00007f31d7f9200b in handle_dispatcher_connect (opaque=<optimized out>, payload=0x55ec3e3f3e70) at red-channel.c:511
#8  0x00007f31d7f7747f in dispatcher_handle_single_read (dispatcher=0x55ec3e3f40a0) at dispatcher.c:287
#9  dispatcher_handle_recv_read (dispatcher=0x55ec3e3f40a0) at dispatcher.c:307
#10 0x00007f31d7f7d79f in watch_func (source=<optimized out>, condition=<optimized out>, data=0x55ec3e3f3ec0) at event-loop.c:119
#11 0x00007f31da5c867d in g_main_dispatch (context=0x55ec3e3f3d30) at gmain.c:3176
#12 g_main_context_dispatch (context=context@entry=0x55ec3e3f3d30) at gmain.c:3829
#13 0x00007f31da5c8a48 in g_main_context_iterate (context=0x55ec3e3f3d30, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3902
#14 0x00007f31da5c8d72 in g_main_loop_run (loop=0x7f31b80024c0) at gmain.c:4098
#15 0x00007f31d7fab47b in red_worker_main (arg=0x55ec3e3f3c60) at red-worker.c:1139
#16 0x00007f31d60d32de in start_thread (arg=<optimized out>) at pthread_create.c:486
#17 0x00007f31d5e04e83 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Coredump of signal 6:
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f31d5d2ab25 in __GI_abort () at abort.c:79
#2  0x00007f31d7fca948 in spice_logv (log_domain=0x7f31d8031cb1 "Spice", args=0x7f31c69fe410, format=0x7f31d8032c75 "condition `%s' failed", 
    function=0x7f31d8032fc0 <__FUNCTION__.47260> "cursor_channel_connect", strloc=0x7f31d8032cff "cursor-channel.c:353", log_level=G_LOG_LEVEL_CRITICAL, 
    log_domain=0x7f31d8031cb1 "Spice") at log.c:58
#3  spice_log (log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, strloc=strloc@entry=0x7f31d8032cff "cursor-channel.c:353", 
    function=function@entry=0x7f31d8032fc0 <__FUNCTION__.47260> "cursor_channel_connect", format=format@entry=0x7f31d8032c75 "condition `%s' failed") at log.c:71
#4  0x00007f31d7f6dcf8 in cursor_channel_connect (cursor=0x55ec3cfec940, client=<optimized out>, stream=0x55ec3e3c8ae0, migrate=1, caps=0x55ec3e3f3e88)
    at cursor-channel.c:353
#5  0x00007f31d7f9200b in handle_dispatcher_connect (opaque=<optimized out>, payload=0x55ec3e3f3e70) at red-channel.c:511
#6  0x00007f31d7f7747f in dispatcher_handle_single_read (dispatcher=0x55ec3e3f40a0) at dispatcher.c:287
#7  dispatcher_handle_recv_read (dispatcher=0x55ec3e3f40a0) at dispatcher.c:307
#8  0x00007f31d7f7d79f in watch_func (source=<optimized out>, condition=<optimized out>, data=0x55ec3e3f3ec0) at event-loop.c:119
#9  0x00007f31da5c867d in g_main_dispatch (context=0x55ec3e3f3d30) at gmain.c:3176
#10 g_main_context_dispatch (context=context@entry=0x55ec3e3f3d30) at gmain.c:3829
#11 0x00007f31da5c8a48 in g_main_context_iterate (context=0x55ec3e3f3d30, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3902
#12 0x00007f31da5c8d72 in g_main_loop_run (loop=0x7f31b80024c0) at gmain.c:4098
#13 0x00007f31d7fab47b in red_worker_main (arg=0x55ec3e3f3c60) at red-worker.c:1139
#14 0x00007f31d60d32de in start_thread (arg=<optimized out>) at pthread_create.c:486
#15 0x00007f31d5e04e83 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95


Expected results:
No assertion failure

Additional info:
Files in attachment:
migrate.sh: script for repeated migration, usage: ./migrate.sh -s <SRC_HOST> -d <DST_HOST> -n <VM_NAME>
spice: script for repeated remote-viewer connection and being killed, Usage: ./spice.sh -h <HOST> -p <PORT>
src-qemu.log: qemu log of src host
dst-qemu.log: qemu log of dst host
gdb-31.txt: full backtrace of coredump by signal 31
gdb-6.txt: full backtrace of coredump by signal 6
VM.xml: the domain xml of VM
Comment 1 Frediano Ziglio 2020-01-21 15:33:54 UTC 
Client channel creation can fail causing this issue. Currently CursorChannelClient and StreamChannelClient are the only channel were this failure are fatal, in all other cases, correctly, the failure cause no harm.
Comment 2 Frediano Ziglio 2020-01-21 15:47:04 UTC 
Posted https://gitlab.freedesktop.org/spice/spice/merge_requests/30.
Comment 3 Frediano Ziglio 2020-02-07 15:05:11 UTC 
Proposed patch merged upstream
Comment 15 errata-xmlrpc 2020-11-04 04:07:31 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (spice bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:4818
Note You need to log in before you can comment on or make changes to this bug.