Bug 522887

Event posted on 09-11-2009 04:53pm EDT by Glen Johnson

=Comment: #0=================================================
SUDHIR KUMAR <sudhirkumarmalik.com> -
---Problem Description---
migrate_set_speed after a migrate_cancel causes segmentation fault in kvm

Contact Information = Sudhir Kumar/sudhirkumarmalik.com

---uname output---
Linux bc1cn3 2.6.18-162.el5 #1 SMP Tue Aug 4 16:24:37 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux

Machine Type = HS22 blade


---Steps to Reproduce---
Start a source Vm:
Start the target vm:
On the source start migration:
migrate -d tcp:0:6000
cancel migration
(qemu) migrate_cancel
(qemu) migrate_set_speed 1g
Segmentation fault

---KVM Component Data---

[root@bc1cn3 images]# rpm -qa | grep kvm
kmod-kvm-83-105.el5
kvm-83-105.el5
etherboot-zroms-kvm-5.4.4-10.el5
kvm-qemu-img-83-105.el5
kvm-tools-83-105.el5


*Additional Instructions for Sudhir Kumar/sudhirkumarmalik.com:
-Post a private note with access information to the machine that the bug is occuring on.

Complete description:
Source VM:

# /usr/libexec/qemu-kvm -hda rhel54-64.raw -m 8192 -smp 4 -net nic -net
tap,script=/root/qemu-ifup-breth2 -name 54_64 -vnc :10 -monitor stdio
(qemu) migrate -d tcp:0:6000
(qemu) migration_notify_done

(qemu) info migrate
Migration status: active
transferred ram: 3218296 kbytes
remaining ram: 5192900 kbytes
total ram: 8409100 kbytes
(qemu) migrate_cancel
migration_notify_done
(qemu) info migrate
Migration status: cancelled
(qemu) migrate_set_speed 1g
Segmentation fault

Here is the segfault shown in dmesg.
qemu-kvm[17043]: segfault at 0000000000000020 rip 0000000000472fa0 rsp 00007fffd54f95d8 error 4

The target VM was started as below.
# /usr/libexec/qemu-kvm -hda rhel54-64.raw -m 8192 -smp 4 -net nic -net
tap,script=/root/qemu-ifup-breth2 -name 54_64_2 -vnc :11 -monitor stdio -incoming tcp:0:6000

Here is the segfault shown in dmesg.
qemu-kvm[17043]: segfault at 0000000000000020 rip 0000000000472fa0 rsp 00007fffd54f95d8 error 4


Generated a core file and ran gdb on it. Here is the backtrace.
(gdb) bt
#0  0x0000000000472fa0 in fprintf ()
#1  0x000000000046c97f in fprintf ()
#2  0x00000000004105f3 in fprintf ()
#3  0x00000000004655e2 in fprintf ()
#4  0x000000000040eb1f in fprintf ()
#5  0x00000000004712e1 in fprintf ()
#6  0x0000000000409722 in fprintf ()
#7  0x00000000004ffd7a in fprintf ()
#8  0x000000000040dbcc in fprintf ()
#9  0x000000351261d994 in __libc_start_main () from /lib64/libc.so.6
#10 0x0000000000406be9 in fprintf ()
#11 0x00007fffabdbc808 in ?? ()
#12 0x0000000000000000 in ?? ()

I could not grab the corresponding sources hence did not try to look into the code.
The issue is not produced when migrate_set_speed is called without calling migrate_cancel prior to it.

Please let me know if further information is required.
=Comment: #3=================================================
Edjunior Barbosa Machado <emachado.ibm.com> -

fix segfault in setting migration speed

This backport patch (based on kvm-83-105.el5.src.rpm from RHEL5.4 RC3) intends to fix the segfault
which occurs when setting a new rate limit after a finished (or canceled/failed) migration.

Original patch:
http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=0bb05eaff04d30609a98c0dae80bb5dba3e4e799
=Comment: #5=================================================
SUDHIR KUMAR <sudhirkumarmalik.com> -
Verified the fix and the fault is no more producible.

=================================================
Hello Red Hat,

please consider the attached backport patch, based on kvm-83-105.el5.src.rpm, which fixed this issue.

Thanks for your support.
This event sent from IssueTracker by jkachuck  [IBM-LTC]
 issue 341626

Created attachment 360744 [details]
set_rate_limit.patch

This is upstream commit 0bb05eaff04d30609a98c0dae80bb5dba3e4e799, not sure why it hasn't been submitted for inclusion.

Doing it now, as the patch fixes the problem for me.

Can reproduce in kvm-83-113.el5

Can not reproduce in kvm-83-119.el5

Could not reproduce in kvm-83-139.el5

*** Bug 511376 has been marked as a duplicate of this bug. ***

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2010-0271.html