Bug 896457
| Summary: | qemu core dump because of SpiceWorker-ERROR | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Xu Tian <xutian> | ||||
| Component: | spice-server | Assignee: | Uri Lublin <uril> | ||||
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 6.4 | CC: | acathrow, bsarathy, cfergeau, dblechte, juzhang, mkenneth, virt-maint | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-07-03 16:07:10 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Not sure it's related, FYI Bug 883654 - qemu crashes when rebooting the guest: SpiceWorker-ERROR **: red_worker.c:4797:qxl_process_cursor: invalid cursor command 235 Bug 887775 - qemu-kvm crashed on ../spice-common/common/ring.h:121:ring_next: assertion `pos->next != NULL && pos->prev != NULL' failed This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. FYI From bt very similar Bug 868807 - Qemu aborted when change the resolution of guest from 1024x768 to 2560x1600 --snip of Bug 868807 bt-- Program received signal SIGABRT, Aborted. 0x00007ffff574c8a5 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff574c8a5 in raise () from /lib64/libc.so.6 #1 0x00007ffff574e085 in abort () from /lib64/libc.so.6 #2 0x00007ffff5fa5c35 in spice_logv (log_domain=0x7ffff6021d9c "SpiceWorker", log_level=SPICE_LOG_LEVEL_CRITICAL, strloc=0x7ffff60220bd "red_worker.c:10916", function= 0x7ffff6023d90 "red_push_monitors_config", format=0x7ffff60220a7 "condition `%s' failed", args=0x7fffe5bfb970) at log.c:109 #3 0x00007ffff5fa5d6a in spice_log (log_domain=<value optimized out>, log_level=<value optimized out>, strloc=<value optimized out>, function=<value optimized out>, format=<value optimized out>) at log.c:123 #4 0x00007ffff5f8390d in on_new_display_channel_client (opaque=<value optimized out>, payload=0x7ffec421d0b0) at red_worker.c:9489 #5 handle_new_display_channel (opaque=<value optimized out>, payload=0x7ffec421d0b0) at red_worker.c:10376 #6 handle_dev_display_connect (opaque=<value optimized out>, payload=0x7ffec421d0b0) at red_worker.c:11216 #7 0x00007ffff5f63cc7 in dispatcher_handle_single_read (dispatcher=0x7ffff8b86c78) at dispatcher.c:139 #8 dispatcher_handle_recv_read (dispatcher=0x7ffff8b86c78) at dispatcher.c:162 #9 0x00007ffff5f8488e in red_worker_main (arg=<value optimized out>) at red_worker.c:11782 #10 0x00007ffff7740851 in start_thread () from /lib64/libpthread.so.0 #11 0x00007ffff580167d in clone () from /lib64/libc.so.6 (gdb) Hi, Xu Would you please update the following 2 question? 1. How reproducible? 2. It is a regressional bug? Best Regards & Thanks, Junyi (In reply to comment #4) > FYI > From bt > very similar Bug 868807 - Qemu aborted when change the resolution of guest > from 1024x768 to 2560x1600 > > --snip of Bug 868807 bt-- > Program received signal SIGABRT, Aborted. > 0x00007ffff574c8a5 in raise () from /lib64/libc.so.6 > (gdb) bt > #0 0x00007ffff574c8a5 in raise () from /lib64/libc.so.6 > #1 0x00007ffff574e085 in abort () from /lib64/libc.so.6 > #2 0x00007ffff5fa5c35 in spice_logv (log_domain=0x7ffff6021d9c > "SpiceWorker", log_level=SPICE_LOG_LEVEL_CRITICAL, strloc=0x7ffff60220bd > "red_worker.c:10916", function= > 0x7ffff6023d90 "red_push_monitors_config", format=0x7ffff60220a7 > "condition `%s' failed", args=0x7fffe5bfb970) at log.c:109 > #3 0x00007ffff5fa5d6a in spice_log (log_domain=<value optimized out>, > log_level=<value optimized out>, strloc=<value optimized out>, > function=<value optimized out>, > format=<value optimized out>) at log.c:123 > #4 0x00007ffff5f8390d in on_new_display_channel_client (opaque=<value > optimized out>, payload=0x7ffec421d0b0) at red_worker.c:9489 > #5 handle_new_display_channel (opaque=<value optimized out>, > payload=0x7ffec421d0b0) at red_worker.c:10376 > #6 handle_dev_display_connect (opaque=<value optimized out>, > payload=0x7ffec421d0b0) at red_worker.c:11216 > #7 0x00007ffff5f63cc7 in dispatcher_handle_single_read > (dispatcher=0x7ffff8b86c78) at dispatcher.c:139 > #8 dispatcher_handle_recv_read (dispatcher=0x7ffff8b86c78) at > dispatcher.c:162 > #9 0x00007ffff5f8488e in red_worker_main (arg=<value optimized out>) at > red_worker.c:11782 > #10 0x00007ffff7740851 in start_thread () from /lib64/libpthread.so.0 > #11 0x00007ffff580167d in clone () from /lib64/libc.so.6 > (gdb) > > Hi, Xu > > Would you please update the following 2 question? > 1. How reproducible? > 2. It is a regressional bug? > > Best Regards & Thanks, > Junyi Hi, Junyi This defeat found in anaysis autotest job reboot testcase, it just happend once and I have try to reporduce but no stable way to reporduce it; thanks, Xu Since this bug only happened once and is not reproducible (comment #5), I'm closing the bug (insufficient data). Please reopen if a way to reproduce this bug is found. |
Created attachment 680129 [details] full backtrace Description of problem: qemu crash when execute reboot test case with autotest tool, in this test autotest will send "screendump /dev/shm/xxx.pmp", and guest reboot in reboot loop too; see backtrack below: (gdb) bt #0 0x00007f41d00378a5 in raise () from /lib64/libc.so.6 #1 0x00007f41d0039085 in abort () from /lib64/libc.so.6 #2 0x00007f41d0891d55 in spice_logv (log_domain=0x7f41d090df3c "SpiceWorker", log_level=SPICE_LOG_LEVEL_ERROR, strloc=0x7f41d090e984 "red_worker.c:4885", function=0x7f41d0910330 "red_process_cursor", format=0x7f41d090e973 "bad command type", args=0x7f41c0dfca00) at log.c:109 #3 0x00007f41d0891e8a in spice_log (log_domain=<value optimized out>, log_level=<value optimized out>, strloc=<value optimized out>, function=<value optimized out>, format=<value optimized out>) at log.c:123 #4 0x00007f41d0858ff5 in red_process_cursor (worker=0x7f41300008c0, ring_is_empty=0x7f41c0dfcbdc, max_pipe_size=50) at red_worker.c:4885 #5 0x00007f41d0870abd in red_worker_main (arg=<value optimized out>) at red_worker.c:11857 #6 0x00007f41d202e851 in start_thread () from /lib64/libpthread.so.0 #7 0x00007f41d00ed90d in clone () from /lib64/libc.so.6 Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. start guest with command: qemu -name 'vm1' -nodefaults -chardev socket,id=qmp_monitor_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130117-162553-O6NU,server,nowait -mon chardev=qmp_monitor_id_qmpmonitor1,mode=control -chardev socket,id=serial_id_20130117-162553-O6NU,path=/tmp/serial-20130117-162553-O6NU,server,nowait -device isa-serial,chardev=serial_id_20130117-162553-O6NU -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 -drive file='/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/RHEL-Server-6.3-64.qcow2',if=none,id=drive-ide0-0-0,media=disk,cache=none,boot=off,snapshot=off,format=qcow2,aio=threads -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -device e1000,netdev=idV7ZVHT,mac=9a:67:50:5c:65:5c,id=ndev00idV7ZVHT,bus=pci.0,addr=0x3 -netdev tap,id=idV7ZVHT,fd=26 -m 2048 -smp 1,cores=0,threads=1,sockets=2 -cpu 'Opteron_G2' -drive file='/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/isos/linux/RHEL6.3-Server-x86_64.iso',if=none,id=drive-ide0-0-1,media=cdrom,snapshot=off,format=raw -device ide-drive,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1 -drive file='/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/rhel63-64/ks.iso',if=none,id=drive-ide0-1-0,media=cdrom,snapshot=off,format=raw -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 -kernel '/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/rhel63-64/vmlinuz' -append 'ks=cdrom nicdelay=60 console=ttyS0,115200 console=tty0' -initrd '/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/rhel63-64/initrd.img' -spice port=3000,password=123456,addr=0,tls-port=3200,x509-dir=/tmp/spice_x509d,tls-channel=main,tls-channel=inputs,image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4 -vga qxl -global qxl-vga.vram_size=33554432 -rtc base=utc,clock=host,driftfix=slew -M rhel6.4.0 -boot order=cdn,once=d,menu=off -no-kvm-pit-reinjection -no-shutdown -enable-kvm 2. send command {'execute': 'human-monitor-command', 'arguments': {'command-line': 'screendump /dev/shm/scrdump-XWlKib.ppm'}, 'id': 'zYKHudxn'} to qmp monior 3. reboot guest in loop with command "shutdown -r now" Actual results: Expected results: Additional info: kernel version: 2.6.32-354.el6.x86_64 qemu version: qemu-kvm-rhev-0.12.1.2-2.352.el6.x86_64 spice-server version: spice-server-0.12.0-12.el6.x86_64