+++ This bug was initially created as a clone of Bug #603026 +++ Commit a82c8e4d836121cec49ccd9031438a3110f2e192 bumped the CPU version to 9, however the format is very different from the version 9 of upstream QEMU. This causes problems in crash, which uses QEMU's savefiles as kvm core dumps. Until now, the differences did nothing problematic, but for version 9 upstream does this: int32_t pending_irq = (int32_t) get_be32 (fp); if (pending_irq >= 0) dx86->kvm.int_bitmap[pending_irq / 64] |= instead of this: for (i = 0; i < 4; i++) dx86->kvm.int_bitmap[i] = get_be64 (fp); (Source code from qemu-load.c in git://git.engineering.redhat.com/users/pbonzini/qemu-reader.git). In other words, the first 32 bits of the bitmap are treated as an index, causing an out-of-bounds access. Of course, adding a "<= 255" check is easily done, but it's only a matter of time until RHEL5's version will hit 12 and we'll have serious problems handling both RHEL5 and RHEL6 dumps. I suggest adding a fake __rhel5 section in the dumps for 5.5.z and 5.6, so that we can look for that in crash. I'll attach the patch soon.
Created attachment 423247 [details] patch to add support for RHEL5.6 and RHEL6 This patch is relative to crash5.0.4p12, and it adds complete support for RHEL5.6 and RHEL6. With this patch it is also possible to load the registers for all CPUs, which may be useful---maybe crash can show the values to the user?
Created attachment 423248 [details] incremental RHEL-only patch This patch, on top of the previous, is suitable for RHEL5.5.z, RHEL5.6, and RHEL6 as it allows reading dumps that do not have a __rhel5 marker. It is not suitable for upstream.
Created attachment 423250 [details] patch to add support for RHEL5.6 and RHEL6 fixed version of attachment 423247 [details]
> This patch, on top of the previous, is suitable for RHEL5.5.z, RHEL5.6, and > RHEL6 as it allows reading dumps that do not have a __rhel5 marker. It is not > suitable for upstream. In off-line discussions, it's been noted that the upstream version of crash should *always* work with RHEL dumpfiles, so both patches will be applied upstream, and the RHEL5 and RHEL6 versions of crash will follow upstream. I have tested the patches against a RHEL5 KVM guest dumpfile taken from a RHEL6 host, and it works OK. I do not have a sample RHEL5 KVM guest dumpfile taken from a RHEL5 host, but Paolo has indicated that he will make one available to me for testing. When that dumpfile is available for testing, I'll devel_ack this BZ and continue the process. I'll also clone this BZ for RHEL6. Thanks, Dave
Paolo's patch has been applied upstream in crash version 5.0.5, and in RHEL6.0 version 5.0.0-19.el6 for the cloned BZ #603142.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: The crash utility has been updated to recognize the "__rhel5" marker that flags the difference between the upstream and Red Hat KVM "virsh dump" CPU device format in the dump file header.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0059.html