From: Stefan Weil <sw@weilnetz.de>
To: "Andreas Färber" <afaerber@suse.de>
Cc: Jan Kiszka <jan.kiszka@siemens.com>,
qemu-devel Developers <qemu-devel@nongnu.org>,
Avi Kivity <avi@redhat.com>
Subject: Re: [Qemu-devel] [TestDays] info mtree abort
Date: Sat, 12 Nov 2011 08:26:53 +0100 [thread overview]
Message-ID: <4EBE1FBD.3030207@weilnetz.de> (raw)
In-Reply-To: <4EBDD460.10103@suse.de>
Am 12.11.2011 03:05, schrieb Andreas Färber:
> Hello,
>
> On current qemu.git master for qemu-system-x86_64 I observe crashes
> similar to this one when running info mtree on the SDL monitor console:
>
> *** glibc detected ***
> /home/andreas/QEMU/qemu-rl78/rl78-softmmu/qemu-system-rl78: free():
> invalid pointer: 0x4545454545454545 ***
>
> #0 0x00007ffff6308d95 in raise () from /lib64/libc.so.6
> #1 0x00007ffff630a2ab in abort () from /lib64/libc.so.6
> #2 0x00007ffff6342ece in __libc_message () from /lib64/libc.so.6
> #3 0x00007ffff6348c06 in malloc_printerr () from /lib64/libc.so.6
> #4 0x00000000004e9024 in mtree_print_mr (mon_printf=0x4ef720
> <monitor_printf>, f=0xf89b10, mr=<optimized out>, level=0, base=0,
> alias_print_queue=0x7fffffffd610)
> at /home/andreas/QEMU/qemu-rl78/memory.c:1405
> #5 0x00000000004ec8b6 in mtree_info (mon_printf=0x4ef720
> <monitor_printf>, f=0xf89b10) at
> /home/andreas/QEMU/qemu-rl78/memory.c:1417
>
> Regards,
> Andreas
qemu-system-i386 also has the same problem. It does not crash
(so most users won't notice anything going wrong), but Valgrind
shows the bug, too:
==29459== Invalid read of size 4
==29459== at 0x81ED59A: mtree_print_mr (memory.c:1404)
==29459== by 0x81ED61E: mtree_info (memory.c:1417)
==29459== by 0x81F1781: do_info_mtree (monitor.c:2247)
==29459== by 0x81EE916: do_info (monitor.c:698)
==29459== by 0x81F4234: handle_user_command (monitor.c:4130)
==29459== by 0x81F57A6: monitor_command_cb (monitor.c:4746)
==29459== by 0x8147992: readline_handle_byte (readline.c:370)
==29459== by 0x81F572A: monitor_read (monitor.c:4732)
==29459== by 0x81385AF: qemu_chr_be_write (qemu-char.c:163)
==29459== by 0x809D1B1: kbd_send_chars (console.c:1124)
==29459== by 0x809D440: kbd_put_keysym (console.c:1183)
==29459== by 0x8163FBA: handle_keydown (sdl.c:724)
==29459== Address 0x12f882c8 is 8 bytes inside a block of size 16 free'd
==29459== at 0x4024B3A: free (vg_replace_malloc.c:366)
==29459== by 0x8116580: free_and_trace (vl.c:2149)
==29459== by 0x4098FC5: g_free (in /lib/libglib-2.0.so.0.2400.1)
==29459== by 0x81ED5AA: mtree_print_mr (memory.c:1405)
==29459== by 0x81ED61E: mtree_info (memory.c:1417)
==29459== by 0x81F1781: do_info_mtree (monitor.c:2247)
==29459== by 0x81EE916: do_info (monitor.c:698)
==29459== by 0x81F4234: handle_user_command (monitor.c:4130)
==29459== by 0x81F57A6: monitor_command_cb (monitor.c:4746)
==29459== by 0x8147992: readline_handle_byte (readline.c:370)
==29459== by 0x81F572A: monitor_read (monitor.c:4732)
==29459== by 0x81385AF: qemu_chr_be_write (qemu-char.c:163)
==29459==
==29459== Invalid read of size 4
==29459== at 0x81ED59A: mtree_print_mr (memory.c:1404)
==29459== by 0x81ED57B: mtree_print_mr (memory.c:1400)
==29459== by 0x81ED68D: mtree_info (memory.c:1423)
==29459== by 0x81F1781: do_info_mtree (monitor.c:2247)
==29459== by 0x81EE916: do_info (monitor.c:698)
==29459== by 0x81F4234: handle_user_command (monitor.c:4130)
==29459== by 0x81F57A6: monitor_command_cb (monitor.c:4746)
==29459== by 0x8147992: readline_handle_byte (readline.c:370)
==29459== by 0x81F572A: monitor_read (monitor.c:4732)
==29459== by 0x81385AF: qemu_chr_be_write (qemu-char.c:163)
==29459== by 0x809D1B1: kbd_send_chars (console.c:1124)
==29459== by 0x809D440: kbd_put_keysym (console.c:1183)
==29459== Address 0x12f88508 is 8 bytes inside a block of size 16 free'd
==29459== at 0x4024B3A: free (vg_replace_malloc.c:366)
==29459== by 0x8116580: free_and_trace (vl.c:2149)
==29459== by 0x4098FC5: g_free (in /lib/libglib-2.0.so.0.2400.1)
==29459== by 0x81ED5AA: mtree_print_mr (memory.c:1405)
==29459== by 0x81ED57B: mtree_print_mr (memory.c:1400)
==29459== by 0x81ED68D: mtree_info (memory.c:1423)
==29459== by 0x81F1781: do_info_mtree (monitor.c:2247)
==29459== by 0x81EE916: do_info (monitor.c:698)
==29459== by 0x81F4234: handle_user_command (monitor.c:4130)
==29459== by 0x81F57A6: monitor_command_cb (monitor.c:4746)
==29459== by 0x8147992: readline_handle_byte (readline.c:370)
==29459== by 0x81F572A: monitor_read (monitor.c:4732)
==29459==
(more bug messages for the same problem follow, I removed them here)
Valgrind was started like this from QEMU's source directory:
valgrind -v --error-limit=no --track-origins=yes --smc-check=all \
--leak-check=full bin/debug/386/i386-softmmu/qemu-system-i386 -L
pc-bios
Regards,
Stefan Weil
next prev parent reply other threads:[~2011-11-12 7:27 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-12 2:05 [Qemu-devel] [TestDays] info mtree abort Andreas Färber
2011-11-12 2:27 ` Andreas Färber
2011-11-12 7:26 ` Stefan Weil [this message]
2011-11-12 9:38 ` Andreas Färber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4EBE1FBD.3030207@weilnetz.de \
--to=sw@weilnetz.de \
--cc=afaerber@suse.de \
--cc=avi@redhat.com \
--cc=jan.kiszka@siemens.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.