RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 656779 - Core dumped when hot plug/un-plug virtio serial port to the same chardev
Summary: Core dumped when hot plug/un-plug virtio serial port to the same chardev
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm
Version: 6.0
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Amit Shah
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks: 580953
TreeView+ depends on / blocked
 
Reported: 2010-11-24 05:03 UTC by Mike Cao
Modified: 2015-11-23 03:33 UTC (History)
8 users (show)

Fixed In Version: qemu-kvm-0.12.1.2-2.162.el6
Doc Type: Bug Fix
Doc Text:
[bug triggered using invalid qemu-kvm configuration, no Errata description required]
Clone Of:
Environment:
Last Closed: 2011-12-06 15:43:53 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1531 0 normal SHIPPED_LIVE Moderate: qemu-kvm security, bug fix, and enhancement update 2011-12-06 01:23:30 UTC

Description Mike Cao 2010-11-24 05:03:17 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
# uname -r 
2.6.32-71.9.1.el6.x86_64
# rpm -q qemu-kvm
qemu-kvm-0.12.1.2-2.113.el6_0.4.x86_64

How reproducible:
100%

Steps to Reproduce:
1.Start VM with
-device virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=4,bus=pci.0 
-chardev socket,path=/tmp/tt,server,nowait,id=channel0 
-device virtserialport,chardev=channel0,name=org.linux-kvm.port.0,bus=virtio-serial0.0,id=port0

2.hot add another virtioserialport with chardev=channel0
(qemu)device_add virtserialport,chardev=channel0,name=org.linux-kvm.port.0,bus=virtio-serial0.0,id=port1

3.remove 2 virtio serial port 
(qemu)device_del port0
(qemu)device_del port1
  
Actual results:
Core dumped

Expected results:
step 2 should not be allowed or steps 3 should not core dump

Additional info:
#0  0x0000003263e329a5 in raise () from /lib64/libc.so.6
#1  0x0000003263e34185 in abort () from /lib64/libc.so.6
#2  0x0000003263e6fd5b in __libc_message () from /lib64/libc.so.6
#3  0x0000003263e75676 in malloc_printerr () from /lib64/libc.so.6
#4  0x00000000004b5e46 in qemu_chr_close (chr=0x166ef30) at qemu-char.c:2491
#5  0x0000000000575bc9 in virtconsole_exitfn (dev=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/hw/virtio-console.c:86
#6  0x0000000000422576 in virtser_port_qdev_exit (qdev=0x1744260)
    at /usr/src/debug/qemu-kvm-0.12.1.2/hw/virtio-serial-bus.c:722
#7  0x00000000004bd83c in qdev_free (dev=0x1744260)
    at /usr/src/debug/qemu-kvm-0.12.1.2/hw/qdev.c:337
#8  0x00000000004bd8c9 in qdev_simple_unplug_cb (dev=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/hw/qdev.c:305
#9  0x00000000004129c0 in monitor_call_handler (mon=<value optimized out>, 
    cmd=0x5810d8, params=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:3921
#10 0x0000000000417750 in handle_user_command (mon=0x1712870, 
    cmdline=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:3958
#11 0x000000000041787a in monitor_command_cb (mon=0x1712870, 
    cmdline=<value optimized out>, opaque=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4506
#12 0x000000000049e5bb in readline_handle_byte (rs=0x2b3ab50, 
---Type <return> to continue, or q <return> to quit---
    ch=<value optimized out>) at readline.c:369
#13 0x00000000004178ec in monitor_read (opaque=<value optimized out>, 
    buf=0x7fffe962c030 "\r", size=1)
    at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4492
#14 0x00000000004b66ab in qemu_chr_read (opaque=0x166edb0) at qemu-char.c:154
#15 fd_chr_read (opaque=0x166edb0) at qemu-char.c:568
#16 0x000000000040b4af in main_loop_wait (timeout=1000)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#17 0x0000000000428c2a in kvm_main_loop ()
    at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2133
#18 0x000000000040e5cb in main_loop (argc=<value optimized out>, 
    argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4444
#19 main (argc=<value optimized out>, argv=<value optimized out>, 
    envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:660
Comment 1 Mike Cao 2010-11-24 05:04:08 UTC 
Tried with 
# rpm -q qemu-kvm
qemu-kvm-0.12.1.2-2.120.el6.x86_64

still hit this issue.
Comment 4 Amit Shah 2011-02-10 07:34:35 UTC 
Patch sent upstream:

http://thread.gmane.org/gmane.comp.emulators.qemu/93315
Comment 11 Shaolong Hu 2011-08-12 03:30:29 UTC 
Reproduced on qemu-kvm-0.12.1.2-2.160.el6.x86_64 as following steps.

Reproduce Procedure:
---------------------
1. boot a guest.
# /usr/libexec/qemu-kvm -enable-kvm -M rhel6.1.0 -smp 4 -m 4G -name rhel6.1-64 -uuid 3f2ea5cd-3d29-48ff-aab2-23df1b6ae213 -drive file=RHEL-Server-6.1-64-virtio.qcow2,cache=none,if=none,rerror=stop,werror=stop,id=drive-virtio-disk0,format=qcow2 -device virtio-blk-pci,drive=drive-virtio-disk0,id=device-virtio-disk0 -netdev tap,script=/etc/qemu-ifup,id=netdev0 -device virtio-net-pci,netdev=netdev0,id=device-net0 -boot order=cd,menu=on -usb -device usb-tablet,id=input0 -monitor stdio -device virtio-serial-pci,id=virtio-serial0,max_ports=16,bus=pci.0,addr=0x5 -chardev socket,id=channel1,path=/tmp/tt,server,nowait -device virtserialport,chardev=channel1,name=port1,bus=virtio-serial0.0,id=port1 -spice disable-ticketing,port=5910

2. in qemu monitor:
   (qemu)  device_add virtserialport,chardev=channel1,name=port1,bus=virtio-serial0.0,id=port2

3.remove 2 virtio serial port 
(qemu)device_del port1
(qemu)device_del port2


Actual results:
----------------
After step 3, qemu-kvm: Aborted (core dumped)


Verify this bug on qemu-kvm-0.12.1.2-2.180.el6.x86_64 as same steps above.

Actual results:
----------------
After step 2:
(qemu) device_add virtserialport,chardev=channel1,name=port1,bus=virtio-serial0.0,id=port2
Property 'virtserialport.chardev' can't take value 'channel1', it's in use


Conclusion:
-------------
According to result above, this bug has been fixed.
Comment 14 Eduardo Habkost 2011-11-22 13:22:11 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
[bug triggered using invalid qemu-kvm configuration, no Errata description required]
Comment 15 errata-xmlrpc 2011-12-06 15:43:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1531.html
Note You need to log in before you can comment on or make changes to this bug.