RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 971724 - qemu core dump when hot-unplug[virtio scsi]
Summary: qemu core dump when hot-unplug[virtio scsi]
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm
Version: 7.0
Hardware: x86_64
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Bandan Das
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-06-07 07:58 UTC by zhonglinzhang
Modified: 2023-09-14 01:45 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
4
Last Closed: 2014-01-03 17:35:13 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description zhonglinzhang 2013-06-07 07:58:27 UTC 
Description of problem:
Boot guest with two virtio scsi disks(scsi0, scsi1), when device_del scsi1,qemu core dump 

Version-Release number of selected component (if applicable):
host:
# uname -r
3.10.0-0.rc3.58.el7.x86_64
qemu-kvm-1.5.0-2.el7.x86_64
guest:
3.10.0-0.rc3.58.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1.start guest with two virtio scsi disk:
/usr/libexec/qemu-kvm -M pc-i440fx-1.5 -cpu SandyBridge -enable-kvm -m 4G -smp 4,sockets=2,cores=2,threads=2 -name scalability-test -uuid 389d06a7-ed36-4fae-baf4-87bdb9b5594e -rtc base=localtime,clock=host,driftfix=slew -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x5 -drive file=/home/rhel7cp5.qcow3,if=none,id=drive-system-disk,media=disk,format=qcow2,aio=native,werror=stop,rerror=stop -device scsi-hd,bus=scsi0.0,drive=drive-system-disk,id=system-disk -device virtio-scsi-pci,id=scsi1,bus=pci.0,addr=0x8 -drive file=/home/adddisk.qcow3,if=none,id=drive-data-disk,format=qcow2,aio=native,werror=stop,rerror=stop -device scsi-hd,bus=scsi1.0,drive=drive-data-disk,id=data-disk -netdev tap,id=hostnet0,vhost=on,script=/etc/qemu-ifup -device virtio-net-pci,netdev=hostnet0,id=virtio-net-pci0,mac=00:22:15:27:54:3d,bus=pci.0,addr=0x9 -k en-us -boot menu=on -vnc :1 -vga cirrus -monitor stdio -qmp tcp:0:5555,server,nowait

2. info block
(qemu) info block
drive-system-disk: removable=0 io-status=ok file=/home/rhel7cp5.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
drive-data-disk: removable=0 io-status=ok file=/home/adddisk.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
ide1-cd0: removable=1 locked=0 tray-open=0 io-status=ok [not inserted]
floppy0: removable=1 locked=0 tray-open=0 [not inserted]
sd0: removable=1 locked=0 tray-open=0 [not inserted]

3. device_del scsi1

4.

Actual results:
qemu core dump
Program received signal SIGABRT, Aborted.
0x00007ffff3940a19 in raise () from /lib64/libc.so.6

bt:
(gdb) bt
#0  0x00007ffff3940a19 in raise () from /lib64/libc.so.6
#1  0x00007ffff3942128 in abort () from /lib64/libc.so.6
#2  0x000055555578b6d3 in kvm_io_ioeventfd_del (listener=<optimized out>, section=0x7fffffffd790, match_data=<optimized out>, 
    data=0, e=<optimized out>) at /usr/src/debug/qemu-1.5.0/kvm-all.c:862
#3  0x0000555555790df0 in address_space_add_del_ioeventfds (fds_old_nb=6, fds_old=0x5555569e3c50, fds_new_nb=3, 
    fds_new=0x5555568727f0, as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:603
#4  address_space_update_ioeventfds (as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:649
#5  address_space_update_topology (as=0x55555645bdc0 <address_space_io>) at /usr/src/debug/qemu-1.5.0/memory.c:730
#6  memory_region_transaction_commit () at /usr/src/debug/qemu-1.5.0/memory.c:750
#7  0x0000555555686aef in pci_unregister_io_regions (pci_dev=0x555556872dd0) at hw/pci/pci.c:889
#8  pci_unregister_device (dev=<optimized out>) at hw/pci/pci.c:900
#9  0x00005555556405d4 in device_unrealize (dev=0x555556872dd0, errp=0x7fffffffd880) at hw/core/qdev.c:191
#10 0x0000555555641cd4 in device_set_realized (obj=0x555556872dd0, value=<optimized out>, err=0x0) at hw/core/qdev.c:715
#11 0x00005555556fe8de in property_set_bool (obj=0x555556872dd0, v=<optimized out>, opaque=0x5555568790b0, name=<optimized out>, 
    errp=0x0) at qom/object.c:1301
#12 0x00005555557011b7 in object_property_set_qobject (obj=0x555556872dd0, value=<optimized out>, name=0x555555870f4d "realized", 
    errp=0x0) at qom/qom-qobject.c:24
#13 0x0000555555700150 in object_property_set_bool (obj=obj@entry=0x555556872dd0, value=value@entry=false, 
    name=name@entry=0x555555870f4d "realized", errp=errp@entry=0x0) at qom/object.c:852
#14 0x00005555556402db in device_unparent (obj=0x555556872dd0) at hw/core/qdev.c:798
#15 0x00005555556ffcea in object_unparent (obj=0x555556872dd0) at qom/object.c:372
#16 0x0000555555640e7d in qdev_free (dev=<optimized out>) at hw/core/qdev.c:286
#17 0x00005555556212a8 in acpi_piix_eject_slot (s=s@entry=0x555556851410, slots=<optimized out>) at hw/acpi/piix4.c:321
#18 0x0000555555621330 in piix4_update_hotplug (s=0x555556851410) at hw/acpi/piix4.c:338
#19 piix4_reset (opaque=0x555556851410) at hw/acpi/piix4.c:375
#20 0x00005555557339cd in qemu_devices_reset () at vl.c:1852
#21 qemu_system_reset (report=report@entry=true) at vl.c:1861
#22 0x00005555555c8d84 in main_loop_should_exit () at vl.c:1995
#23 main_loop () at vl.c:2033
#24 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4419

Expected results:
qemu works well

Additional info:
Comment 2 zhonglinzhang 2013-06-07 09:32:00 UTC 
Please note:

This issue can reproduced on qemu-kvm-1.5.0-2.el7.x86_64 but can not reproduced on qemu-kvm-1.4.0-4.el7. Might be a regression which is introduced from qemu1.5.

Set the Priority and  Severity as urgent.
Comment 5 Red Hat Bugzilla 2023-09-14 01:45:17 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days
Note You need to log in before you can comment on or make changes to this bug.