Bug 745758
| Summary: | Segmentation fault occurs after hot unplug virtio-serial-pci while virtio-serial-port in use | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Mike Cao <bcao> |
| Component: | qemu-kvm | Assignee: | Amit Shah <amit.shah> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.2 | CC: | acathrow, amit.shah, bcao, juzhang, michen, mkenneth, qzhang, shuang, shu, tburke, virt-maint |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | qemu-kvm-0.12.1.2-2.211.el6 | Doc Type: | Bug Fix |
| Doc Text: |
No documentation necessary
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-06-20 11:35:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Mike Cao
2011-10-13 10:15:01 UTC
(qemu) device_del virtio-serial0
(qemu)
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0 0x0000000000000000 in ?? ()
#1 0x000000000040c546 in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3890
#2 0x000000000042a63a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2194
#3 0x000000000040dc9f in main_loop (argc=<value optimized out>, argv=<value optimized out>,
envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4095
#4 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6323
*** Bug 759011 has been marked as a duplicate of this bug. *** Backtrace from recent qemu from bug 759011 Core was generated by `/usr/libexec/qemu-kvm -M rhel6.2.0 -enable-kvm -m 2048 -smp 2,sockets=2,cores=1'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in ?? () #1 0x000000000040c5ce in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029 #2 0x000000000042aefa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225 #3 0x000000000040de85 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234 #4 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470 vl.c:4029 is:
main_loop_wait():
QLIST_FOREACH(ioh, &io_handlers, next) {
if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) {
ioh->fd_read(ioh->opaque);
if (!(ioh->fd_read_poll && ioh->fd_read_poll(ioh->opaque)))
FD_CLR(ioh->fd, &rfds);
}
if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) {
4029: ioh->fd_write(ioh->opaque);
}
}
That explains what happens: output from guest gets throttled, callback gets registered (qemu-char.c:char_write_unblocked()). In the meantime, the device is yanked off, resulting in chr's handlers becoming NULL, resulting in this segfault when the char device becomes writable again.
Fix will be RHEL-only, since the throttling patches aren't upstream.
For testing, please test both, linux and windows guests. From the comments in bug 759011, this bug is easily reproducible in windows guests but not linux guests (but the guest type doesn't really matter -- what matters is the throttling gets activated and the device is removed when throttling is on). Reproduced the bug on qemu-kvm-0.12.1.2-2.209.el6 and verified pass on qemu-kvm-0.12.1.2-2.221.el6 with the same steps as bug description.
Note: In the step 3 when reading data from virtio serial on the host side, no need to redirect the output to a file, otherwise it will be hard to reproduce.
On qemu-kvm-0.12.1.2-2.209.el6:
(qemu) device_del virtio-serial0
(qemu)
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb)
(gdb)
(gdb) bt
#0 0x0000000000000000 in ?? ()
#1 0x000000000040c5ce in main_loop_wait (timeout=1000)
at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029
#2 0x000000000042aefa in kvm_main_loop ()
at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#3 0x000000000040de85 in main_loop (argc=<value optimized out>,
argv=<value optimized out>, envp=<value optimized out>)
at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#4 main (argc=<value optimized out>, argv=<value optimized out>,
envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470
On qemu-kvm-0.12.1.2-2.221.el6, after several times attempts, no segment fault happens. The device can be removed successfully and guest works well.
So this issue is fixed.
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
No documentation necessary
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0746.html |