* [Qemu-devel] Crash with odd chardev setup
@ 2017-10-25 18:00 Dr. David Alan Gilbert
2017-10-25 21:23 ` Daniel P. Berrange
0 siblings, 1 reply; 4+ messages in thread
From: Dr. David Alan Gilbert @ 2017-10-25 18:00 UTC (permalink / raw)
To: qemu-devel
Hi Dan,
I've got a crash in head (and 2.10) which is a bit of a heisenbug;
I can trigger it with:
./qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
and then 'q' to quit.
Note I'm not doing a redirect in of fd 10.
It goes away if I remove either the -netdev or the -chardev option.
It doesn't trigger under gdb, but fortunately we get a core:
#0 0x000055a226d94a2e in socket_listen_cleanup (fd=<optimized out>, errp=errp@entry=0x7fff3585e8c0)
at /root/qemu/util/qemu-sockets.c:1077
1077 if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
1078 && addr->u.q_unix.path) {
1079 if (unlink(addr->u.q_unix.path) < 0 && errno != ENOENT) {
#1 0x000055a226d4242b in qio_channel_socket_finalize (obj=<optimized out>) at /root/qemu/io/channel-socket.c:388
#2 0x000055a226cbca92 in object_unref (type=<optimized out>, obj=0x55a2290ab400) at /root/qemu/qom/object.c:462
#3 0x000055a226cbca92 in object_unref (data=0x55a2290ab400) at /root/qemu/qom/object.c:476
#4 0x000055a226cbca92 in object_unref (obj=0x55a2290ab400) at /root/qemu/qom/object.c:911
#5 0x000055a226d334c9 in char_socket_finalize (obj=<optimized out>) at /root/qemu/chardev/char-socket.c:805
#6 0x000055a226cbca92 in object_unref (type=<optimized out>, obj=0x55a2290aa7f0) at /root/qemu/qom/object.c:462
#7 0x000055a226cbca92 in object_unref (data=0x55a2290aa7f0) at /root/qemu/qom/object.c:476
#8 0x000055a226cbca92 in object_unref (obj=0x55a2290aa7f0) at /root/qemu/qom/object.c:911
#9 0x000055a226cbcacc in object_unref (obj=0x55a2290ab7a0) at /root/qemu/qom/object.c:413
#10 0x000055a226cbcacc in object_unref (data=0x55a2290ab7a0) at /root/qemu/qom/object.c:475
#11 0x000055a226cbcacc in object_unref (obj=0x55a2290ab7a0) at /root/qemu/qom/object.c:911
#12 0x000055a226cbba87 in object_property_del_child (obj=0x55a22909e770, child=0x55a2290ab7a0, errp=0x0)
at /root/qemu/qom/object.c:436
#13 0x000055a226cbc2e4 in object_unparent (obj=<optimized out>) at /root/qemu/qom/object.c:455
#14 0x000055a226d2e7e5 in qemu_chr_cleanup () at /root/qemu/chardev/char.c:1090
#15 0x000055a2269c73ff in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>)
at /root/qemu/vl.c:4914
Dave
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] Crash with odd chardev setup
2017-10-25 18:00 [Qemu-devel] Crash with odd chardev setup Dr. David Alan Gilbert
@ 2017-10-25 21:23 ` Daniel P. Berrange
2017-10-26 13:41 ` Dr. David Alan Gilbert
0 siblings, 1 reply; 4+ messages in thread
From: Daniel P. Berrange @ 2017-10-25 21:23 UTC (permalink / raw)
To: Dr. David Alan Gilbert; +Cc: qemu-devel
On Wed, Oct 25, 2017 at 07:00:14PM +0100, Dr. David Alan Gilbert wrote:
> Hi Dan,
> I've got a crash in head (and 2.10) which is a bit of a heisenbug;
> I can trigger it with:
>
> ./qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
>
> and then 'q' to quit.
Hmm, that doesn't trigger for me on git master at least.
> Note I'm not doing a redirect in of fd 10.
So it's trying & failing to setup the tap dev, right ?
eg you see this:
# ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
qemu-system-x86_64: -netdev tap,id=hostnet0,vhost=on,fd=10: TUNGETIFF ioctl() failed: Invalid argument
QEMU 2.10.50 monitor - type 'help' for more information
(qemu) qemu-system-x86_64: warning: netdev hostnet0 has no peer
(qemu) q
Except it crashes at the end ?
> It goes away if I remove either the -netdev or the -chardev option.
>
> It doesn't trigger under gdb, but fortunately we get a core:
>
> #0 0x000055a226d94a2e in socket_listen_cleanup (fd=<optimized out>, errp=errp@entry=0x7fff3585e8c0)
> at /root/qemu/util/qemu-sockets.c:1077
> 1077 if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
> 1078 && addr->u.q_unix.path) {
> 1079 if (unlink(addr->u.q_unix.path) < 0 && errno != ENOENT) {
Can you see from the core whether one of those pointers is NULL, or is there
a complete garbage pointer ?
I wonder if it triggers if you run QEMU under valgrind ?
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] Crash with odd chardev setup
2017-10-25 21:23 ` Daniel P. Berrange
@ 2017-10-26 13:41 ` Dr. David Alan Gilbert
2017-10-27 10:31 ` Dr. David Alan Gilbert
0 siblings, 1 reply; 4+ messages in thread
From: Dr. David Alan Gilbert @ 2017-10-26 13:41 UTC (permalink / raw)
To: Daniel P. Berrange; +Cc: qemu-devel
* Daniel P. Berrange (berrange@redhat.com) wrote:
> On Wed, Oct 25, 2017 at 07:00:14PM +0100, Dr. David Alan Gilbert wrote:
> > Hi Dan,
> > I've got a crash in head (and 2.10) which is a bit of a heisenbug;
> > I can trigger it with:
> >
> > ./qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
> >
> > and then 'q' to quit.
>
> Hmm, that doesn't trigger for me on git master at least.
Hmm.
> > Note I'm not doing a redirect in of fd 10.
>
> So it's trying & failing to setup the tap dev, right ?
>
> eg you see this:
>
> # ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
> qemu-system-x86_64: -netdev tap,id=hostnet0,vhost=on,fd=10: TUNGETIFF ioctl() failed: Invalid argument
> QEMU 2.10.50 monitor - type 'help' for more information
> (qemu) qemu-system-x86_64: warning: netdev hostnet0 has no peer
>
> (qemu) q
>
>
> Except it crashes at the end ?
Right.
>
>
> > It goes away if I remove either the -netdev or the -chardev option.
> >
> > It doesn't trigger under gdb, but fortunately we get a core:
> >
> > #0 0x000055a226d94a2e in socket_listen_cleanup (fd=<optimized out>, errp=errp@entry=0x7fff3585e8c0)
> > at /root/qemu/util/qemu-sockets.c:1077
> > 1077 if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
> > 1078 && addr->u.q_unix.path) {
> > 1079 if (unlink(addr->u.q_unix.path) < 0 && errno != ENOENT) {
>
> Can you see from the core whether one of those pointers is NULL, or is there
> a complete garbage pointer ?
Gdb showed all the pointers as optimised out I think.
> I wonder if it triggers if you run QEMU under valgrind ?
It does, but it shows:
==29930== Thread 1:
==29930== Invalid read of size 4
==29930== at 0x6F3A2E: socket_listen_cleanup (qemu-sockets.c:1077)
==29930== by 0x6A142A: qio_channel_socket_finalize (channel-socket.c:388)
==29930== by 0x61BA91: object_deinit (object.c:462)
==29930== by 0x61BA91: object_finalize (object.c:476)
==29930== by 0x61BA91: object_unref (object.c:911)
==29930== by 0x6924C8: char_socket_finalize (char-socket.c:805)
==29930== by 0x61BA91: object_deinit (object.c:462)
==29930== by 0x61BA91: object_finalize (object.c:476)
==29930== by 0x61BA91: object_unref (object.c:911)
==29930== by 0x61BACB: object_property_del_all (object.c:413)
==29930== by 0x61BACB: object_finalize (object.c:475)
==29930== by 0x61BACB: object_unref (object.c:911)
==29930== by 0x61AA86: object_property_del_child.isra.7 (object.c:436)
==29930== by 0x3263FE: main (vl.c:4914)
==29930== Address 0x0 is not stack'd, malloc'd or (recently) free'd
so I guess one of the pointers is NULL; I guess I need a few printf's.
Dave
>
> Regards,
> Daniel
> --
> |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o- https://fstop138.berrange.com :|
> |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] Crash with odd chardev setup
2017-10-26 13:41 ` Dr. David Alan Gilbert
@ 2017-10-27 10:31 ` Dr. David Alan Gilbert
0 siblings, 0 replies; 4+ messages in thread
From: Dr. David Alan Gilbert @ 2017-10-27 10:31 UTC (permalink / raw)
To: Daniel P. Berrange; +Cc: qemu-devel, armbru
* Dr. David Alan Gilbert (dgilbert@redhat.com) wrote:
> * Daniel P. Berrange (berrange@redhat.com) wrote:
> > On Wed, Oct 25, 2017 at 07:00:14PM +0100, Dr. David Alan Gilbert wrote:
> > > Hi Dan,
> > > I've got a crash in head (and 2.10) which is a bit of a heisenbug;
> > > I can trigger it with:
> > >
> > > ./qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
> > >
> > > and then 'q' to quit.
> >
> > Hmm, that doesn't trigger for me on git master at least.
>
> Hmm.
>
> > > Note I'm not doing a redirect in of fd 10.
> >
> > So it's trying & failing to setup the tap dev, right ?
> >
> > eg you see this:
> >
> > # ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10 -chardev socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait -monitor stdio -vnc :0
> > qemu-system-x86_64: -netdev tap,id=hostnet0,vhost=on,fd=10: TUNGETIFF ioctl() failed: Invalid argument
> > QEMU 2.10.50 monitor - type 'help' for more information
> > (qemu) qemu-system-x86_64: warning: netdev hostnet0 has no peer
> >
> > (qemu) q
> >
> >
> > Except it crashes at the end ?
>
> Right.
>
> >
> >
> > > It goes away if I remove either the -netdev or the -chardev option.
> > >
> > > It doesn't trigger under gdb, but fortunately we get a core:
> > >
> > > #0 0x000055a226d94a2e in socket_listen_cleanup (fd=<optimized out>, errp=errp@entry=0x7fff3585e8c0)
> > > at /root/qemu/util/qemu-sockets.c:1077
> > > 1077 if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
> > > 1078 && addr->u.q_unix.path) {
> > > 1079 if (unlink(addr->u.q_unix.path) < 0 && errno != ENOENT) {
> >
> > Can you see from the core whether one of those pointers is NULL, or is there
> > a complete garbage pointer ?
>
> Gdb showed all the pointers as optimised out I think.
>
> > I wonder if it triggers if you run QEMU under valgrind ?
>
> It does, but it shows:
> ==29930== Thread 1:
> ==29930== Invalid read of size 4
> ==29930== at 0x6F3A2E: socket_listen_cleanup (qemu-sockets.c:1077)
> ==29930== by 0x6A142A: qio_channel_socket_finalize (channel-socket.c:388)
> ==29930== by 0x61BA91: object_deinit (object.c:462)
> ==29930== by 0x61BA91: object_finalize (object.c:476)
> ==29930== by 0x61BA91: object_unref (object.c:911)
> ==29930== by 0x6924C8: char_socket_finalize (char-socket.c:805)
> ==29930== by 0x61BA91: object_deinit (object.c:462)
> ==29930== by 0x61BA91: object_finalize (object.c:476)
> ==29930== by 0x61BA91: object_unref (object.c:911)
> ==29930== by 0x61BACB: object_property_del_all (object.c:413)
> ==29930== by 0x61BACB: object_finalize (object.c:475)
> ==29930== by 0x61BACB: object_unref (object.c:911)
> ==29930== by 0x61AA86: object_property_del_child.isra.7 (object.c:436)
> ==29930== by 0x3263FE: main (vl.c:4914)
> ==29930== Address 0x0 is not stack'd, malloc'd or (recently) free'd
>
> so I guess one of the pointers is NULL; I guess I need a few printf's.
I can get rid of the actual crash by changing socket_listen_cleanup;
@@ -1074,7 +1074,7 @@ void socket_listen_cleanup(int fd, Error **errp)
addr = socket_local_address(fd, errp);
- if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
+ if (addr && addr->type == SOCKET_ADDRESS_TYPE_UNIX
&& addr->u.q_unix.path) {
socket_local_address is failing with :
socket_listen_cleanup: fd=10 addr=(nil)
qemu-system-x86_64: Unable to query local socket address: Bad file descriptor
The difference under gdb seems to be the fd in cleanup is fd=14 so isn't
the same one as the bad fd passed in (I don't really understand why).
Dave
> Dave
>
> >
> > Regards,
> > Daniel
> > --
> > |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
> > |: https://libvirt.org -o- https://fstop138.berrange.com :|
> > |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
> --
> Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-10-27 10:32 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-25 18:00 [Qemu-devel] Crash with odd chardev setup Dr. David Alan Gilbert
2017-10-25 21:23 ` Daniel P. Berrange
2017-10-26 13:41 ` Dr. David Alan Gilbert
2017-10-27 10:31 ` Dr. David Alan Gilbert
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.