Hide Forgot
Description of problem: Version-Release number of selected component (if applicable): hostinfo: uname -r 2.6.32-206.el6.x86_64 # rpm -q qemu-kvm qemu-kvm-0.12.1.2-2.195.el6.x86_64 Guest info 2.6.32-206.el6.x86_64 How reproducible: 100% Steps to Reproduce: 1.start guest with virtio-serial-pci and virtio-serial-port eg:/usr/libexec/qemu-kvm -M rhel6.2.0 -enable-kvm -cpu cpu64-rhel6,family=0x6 -m 4G -boot nc -smp 2 -name RHEL6 -uuid 0b54584e-ce8e-47e0-b1fe-622177beae61 -monitor stdio -rtc base=localtime -drive file=/home/Bug699358,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-pci,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -netdev tap,id=hostnet0,vhost=on,script=/etc/qemu-ifup,downscript=no -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:9e:23:01,bus=pci.0,addr=0x3 -usb -device usb-tablet,id=input0 -vnc :1 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,bus=pci.0 -chardev socket,id=channel0,path=/tmp/socket0,server,nowait -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=channel0,name=org.port0,id=port0 2.in the guest #hexdump -C /dev/vda > /dev/vport0p1 3.on the host #nc -U /tmp/virtio-socket0 4.after 3 mins , (qemu)device_del virtio-serial0 Actual results: qemu-kvm quit with segmentation fault Expected results: Additional info: the core file is as larger as 460MB ,but call trace can not displayed successfully. I will provide the backtrace after installing all the missing debuginfos
(qemu) device_del virtio-serial0 (qemu) Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in ?? () #1 0x000000000040c546 in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3890 #2 0x000000000042a63a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2194 #3 0x000000000040dc9f in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4095 #4 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6323
*** Bug 759011 has been marked as a duplicate of this bug. ***
Backtrace from recent qemu from bug 759011 Core was generated by `/usr/libexec/qemu-kvm -M rhel6.2.0 -enable-kvm -m 2048 -smp 2,sockets=2,cores=1'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in ?? () #1 0x000000000040c5ce in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029 #2 0x000000000042aefa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225 #3 0x000000000040de85 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234 #4 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470
vl.c:4029 is: main_loop_wait(): QLIST_FOREACH(ioh, &io_handlers, next) { if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) { ioh->fd_read(ioh->opaque); if (!(ioh->fd_read_poll && ioh->fd_read_poll(ioh->opaque))) FD_CLR(ioh->fd, &rfds); } if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) { 4029: ioh->fd_write(ioh->opaque); } } That explains what happens: output from guest gets throttled, callback gets registered (qemu-char.c:char_write_unblocked()). In the meantime, the device is yanked off, resulting in chr's handlers becoming NULL, resulting in this segfault when the char device becomes writable again. Fix will be RHEL-only, since the throttling patches aren't upstream.
For testing, please test both, linux and windows guests. From the comments in bug 759011, this bug is easily reproducible in windows guests but not linux guests (but the guest type doesn't really matter -- what matters is the throttling gets activated and the device is removed when throttling is on).
Reproduced the bug on qemu-kvm-0.12.1.2-2.209.el6 and verified pass on qemu-kvm-0.12.1.2-2.221.el6 with the same steps as bug description. Note: In the step 3 when reading data from virtio serial on the host side, no need to redirect the output to a file, otherwise it will be hard to reproduce. On qemu-kvm-0.12.1.2-2.209.el6: (qemu) device_del virtio-serial0 (qemu) Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) (gdb) (gdb) bt #0 0x0000000000000000 in ?? () #1 0x000000000040c5ce in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029 #2 0x000000000042aefa in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225 #3 0x000000000040de85 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234 #4 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470 On qemu-kvm-0.12.1.2-2.221.el6, after several times attempts, no segment fault happens. The device can be removed successfully and guest works well. So this issue is fixed.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: No documentation necessary
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0746.html