Bug 971724 - qemu core dump when hot-unplug[virtio scsi] [NEEDINFO]
qemu core dump when hot-unplug[virtio scsi]
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
x86_64 Linux
urgent Severity urgent
: rc
: ---
Assigned To: Bandan Das
Virtualization Bugs
Depends On:
  Show dependency treegraph
Reported: 2013-06-07 03:58 EDT by zhonglinzhang
Modified: 2014-01-03 12:35 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-01-03 12:35:13 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
sluo: needinfo? (zhzhang)

Attachments (Terms of Use)

  None (edit)
Description zhonglinzhang 2013-06-07 03:58:27 EDT
Description of problem:
Boot guest with two virtio scsi disks(scsi0, scsi1), when device_del scsi1,qemu core dump 

Version-Release number of selected component (if applicable):
# uname -r

How reproducible:

Steps to Reproduce:
1.start guest with two virtio scsi disk:
/usr/libexec/qemu-kvm -M pc-i440fx-1.5 -cpu SandyBridge -enable-kvm -m 4G -smp 4,sockets=2,cores=2,threads=2 -name scalability-test -uuid 389d06a7-ed36-4fae-baf4-87bdb9b5594e -rtc base=localtime,clock=host,driftfix=slew -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x5 -drive file=/home/rhel7cp5.qcow3,if=none,id=drive-system-disk,media=disk,format=qcow2,aio=native,werror=stop,rerror=stop -device scsi-hd,bus=scsi0.0,drive=drive-system-disk,id=system-disk -device virtio-scsi-pci,id=scsi1,bus=pci.0,addr=0x8 -drive file=/home/adddisk.qcow3,if=none,id=drive-data-disk,format=qcow2,aio=native,werror=stop,rerror=stop -device scsi-hd,bus=scsi1.0,drive=drive-data-disk,id=data-disk -netdev tap,id=hostnet0,vhost=on,script=/etc/qemu-ifup -device virtio-net-pci,netdev=hostnet0,id=virtio-net-pci0,mac=00:22:15:27:54:3d,bus=pci.0,addr=0x9 -k en-us -boot menu=on -vnc :1 -vga cirrus -monitor stdio -qmp tcp:0:5555,server,nowait

2. info block
(qemu) info block
drive-system-disk: removable=0 io-status=ok file=/home/rhel7cp5.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
drive-data-disk: removable=0 io-status=ok file=/home/adddisk.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
ide1-cd0: removable=1 locked=0 tray-open=0 io-status=ok [not inserted]
floppy0: removable=1 locked=0 tray-open=0 [not inserted]
sd0: removable=1 locked=0 tray-open=0 [not inserted]

3. device_del scsi1


Actual results:
qemu core dump
Program received signal SIGABRT, Aborted.
0x00007ffff3940a19 in raise () from /lib64/libc.so.6

(gdb) bt
#0  0x00007ffff3940a19 in raise () from /lib64/libc.so.6
#1  0x00007ffff3942128 in abort () from /lib64/libc.so.6
#2  0x000055555578b6d3 in kvm_io_ioeventfd_del (listener=<optimized out>, section=0x7fffffffd790, match_data=<optimized out>, 
    data=0, e=<optimized out>) at /usr/src/debug/qemu-1.5.0/kvm-all.c:862
#3  0x0000555555790df0 in address_space_add_del_ioeventfds (fds_old_nb=6, fds_old=0x5555569e3c50, fds_new_nb=3, 
    fds_new=0x5555568727f0, as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:603
#4  address_space_update_ioeventfds (as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:649
#5  address_space_update_topology (as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:730
#6  memory_region_transaction_commit () at /usr/src/debug/qemu-1.5.0/memory.c:750
#7  0x0000555555686aef in pci_unregister_io_regions (pci_dev=0x555556872dd0) at hw/pci/pci.c:889
#8  pci_unregister_device (dev=<optimized out>) at hw/pci/pci.c:900
#9  0x00005555556405d4 in device_unrealize (dev=0x555556872dd0, errp=0x7fffffffd880) at hw/core/qdev.c:191
#10 0x0000555555641cd4 in device_set_realized (obj=0x555556872dd0, value=<optimized out>, err=0x0) at hw/core/qdev.c:715
#11 0x00005555556fe8de in property_set_bool (obj=0x555556872dd0, v=<optimized out>, opaque=0x5555568790b0, name=<optimized out>, 
    errp=0x0) at qom/object.c:1301
#12 0x00005555557011b7 in object_property_set_qobject (obj=0x555556872dd0, value=<optimized out>, name=0x555555870f4d "realized", 
    errp=0x0) at qom/qom-qobject.c:24
#13 0x0000555555700150 in object_property_set_bool (obj=obj@entry=0x555556872dd0, value=value@entry=false, 
    name=name@entry=0x555555870f4d "realized", errp=errp@entry=0x0) at qom/object.c:852
#14 0x00005555556402db in device_unparent (obj=0x555556872dd0) at hw/core/qdev.c:798
#15 0x00005555556ffcea in object_unparent (obj=0x555556872dd0) at qom/object.c:372
#16 0x0000555555640e7d in qdev_free (dev=<optimized out>) at hw/core/qdev.c:286
#17 0x00005555556212a8 in acpi_piix_eject_slot (s=s@entry=0x555556851410, slots=<optimized out>) at hw/acpi/piix4.c:321
#18 0x0000555555621330 in piix4_update_hotplug (s=0x555556851410) at hw/acpi/piix4.c:338
#19 piix4_reset (opaque=0x555556851410) at hw/acpi/piix4.c:375
#20 0x00005555557339cd in qemu_devices_reset () at vl.c:1852
#21 qemu_system_reset (report=report@entry=true) at vl.c:1861
#22 0x00005555555c8d84 in main_loop_should_exit () at vl.c:1995
#23 main_loop () at vl.c:2033
#24 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4419

Expected results:
qemu works well

Additional info:
Comment 2 zhonglinzhang 2013-06-07 05:32:00 EDT
Please note:

This issue can reproduced on qemu-kvm-1.5.0-2.el7.x86_64 but can not reproduced on qemu-kvm-1.4.0-4.el7. Might be a regression which is introduced from qemu1.5.

Set the Priority and  Severity as urgent.

Note You need to log in before you can comment on or make changes to this bug.