[Qemu-devel] Hot unplug of pci-serial-2x crashes

[Markus Armbruster <armbru@redhat.com>]

Start QEMU with a pci-serial-2x device:

    -chardev file,path=/dev/null,id=foo2
    -chardev file,path=/dev/null,id=foo3
    -device id=gg,driver=pci-serial-2x,chardev1=foo2,chardev2=foo3

Wait until the guest finishes booting (F-19 in my case), then hot unplug
the device:

    (qemu) device_del gg
    (qemu) qemu-system-x86_64: /work/armbru/tmp/qemu/memory.c:1021: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
    Aborted (core dumped)

Backtrace:

#0  0x00007fffedecec39 in raise () from /lib64/libc.so.6
#1  0x00007fffeded0348 in abort () from /lib64/libc.so.6
#2  0x00007fffedec7b96 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007fffedec7c42 in __assert_fail () from /lib64/libc.so.6
#4  0x0000555555644908 in memory_region_destroy (mr=0x555556467ae0)
    at /work/armbru/qemu/memory.c:1118
#5  0x000055555578e4a8 in multi_serial_pci_exit (dev=0x555556467360)
    at /work/armbru/qemu/hw/char/serial-pci.c:154
#6  0x00005555557e3320 in pci_unregister_device (dev=<optimized out>)
    at /work/armbru/qemu/hw/pci/pci.c:909
#7  0x0000555555790234 in device_unrealize (dev=0x555556467360, 
    errp=0x7fffe2e8d8c0) at /work/armbru/qemu/hw/core/qdev.c:196
#8  0x0000555555791648 in device_set_realized (obj=<optimized out>, 
    value=<optimized out>, errp=0x0) at /work/armbru/qemu/hw/core/qdev.c:863
#9  0x000055555583c9ae in property_set_bool (obj=0x555556467360, 
    v=<optimized out>, opaque=0x555556421180, name=<optimized out>, errp=0x0)
    at /work/armbru/qemu/qom/object.c:1456
#10 0x000055555583f1c7 in object_property_set_qobject (obj=0x555556467360, 
    value=<optimized out>, name=0x555555909cd8 "realized", errp=0x0)
    at /work/armbru/qemu/qom/qom-qobject.c:24
#11 0x000055555583dee0 in object_property_set_bool (
    obj=obj@entry=0x555556467360, value=value@entry=false, 
    name=name@entry=0x555555909cd8 "realized", errp=errp@entry=0x0)
    at /work/armbru/qemu/qom/object.c:884
#12 0x000055555578ff9c in device_unparent (obj=0x555556467360)
    at /work/armbru/qemu/hw/core/qdev.c:978
#13 0x000055555583db91 in object_unparent (obj=0x555556467360)
    at /work/armbru/qemu/qom/object.c:401
#14 0x000055555576d336 in acpi_pcihp_eject_slot (s=<optimized out>, 
    bsel=<optimized out>, slots=<optimized out>)
    at /work/armbru/qemu/hw/acpi/pcihp.c:139
#15 0x00005555556416b2 in access_with_adjusted_size (addr=addr@entry=8, 
    value=value@entry=0x7fffe2e8dab0, size=size@entry=4, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, access=
    0x555555641b00 <memory_region_write_accessor>, mr=0x5555563c5c18)
    at /work/armbru/qemu/memory.c:480
#16 0x0000555555645dc6 in memory_region_dispatch_write (size=4, data=16, 
    addr=8, mr=0x5555563c5c18) at /work/armbru/qemu/memory.c:1004
#17 io_mem_write (mr=mr@entry=0x5555563c5c18, addr=8, val=<optimized out>, 
    size=4) at /work/armbru/qemu/memory.c:1812
#18 0x0000555555610713 in address_space_rw (
    as=0x555555d373c0 <address_space_io>, addr=addr@entry=44552, 
    buf=0x7ffff7ff7000 "\020", len=len@entry=4, is_write=is_write@entry=true)
    at /work/armbru/qemu/exec.c:2047
#19 0x0000555555640a18 in kvm_handle_io (count=1, size=4, 
    direction=<optimized out>, data=<optimized out>, port=44552)
    at /work/armbru/qemu/kvm-all.c:1597
#20 kvm_cpu_exec (cpu=cpu@entry=0x5555563a3470)
    at /work/armbru/qemu/kvm-all.c:1734
#21 0x000055555562ef92 in qemu_kvm_cpu_thread_fn (arg=0x5555563a3470)
    at /work/armbru/qemu/cpus.c:874
#22 0x00007ffff6ba0f33 in start_thread () from /lib64/libpthread.so.0
#23 0x00007fffedf8dded in clone () from /lib64/libc.so.6