From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1LPuAP-0007LV-OG
	for qemu-devel@nongnu.org; Thu, 22 Jan 2009 02:39:57 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1LPuAO-0007K6-Mu
	for qemu-devel@nongnu.org; Thu, 22 Jan 2009 02:39:56 -0500
Received: from [199.232.76.173] (port=53046 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1LPuAO-0007Js-Gu
	for qemu-devel@nongnu.org; Thu, 22 Jan 2009 02:39:56 -0500
Received: from mx2.redhat.com ([66.187.237.31]:49449)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <gleb@redhat.com>) id 1LPuAN-0001EG-W1
	for qemu-devel@nongnu.org; Thu, 22 Jan 2009 02:39:56 -0500
Date: Thu, 22 Jan 2009 09:38:00 +0200
From: Gleb Natapov <gleb@redhat.com>
Subject: Re: [Qemu-devel] [BUG] Regression in networking code (SIGSEGV)
Message-ID: <20090122073800.GK27675@redhat.com>
References: <497790E0.7050905@mail.berlios.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <497790E0.7050905@mail.berlios.de>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Weil <weil@mail.berlios.de>
Cc: QEMU Developers <qemu-devel@nongnu.org>

On Wed, Jan 21, 2009 at 10:17:20PM +0100, Stefan Weil wrote:
> Hi,
> 
> the SIGSEGV crash below can be reproduced with Qemu r6391 and "high" net
> load.
> 
> I bootet a mips malta kernel from a debian nfs root. While this worked fine,
> aptitude update hangs during downloads, nfs root is lost and after some time
> Qemu gets a SIGSEGV.
> 
> A similar crash occurs with a different mips machine (ar7) and different
> network hardware (ar7 emac / cpmac), so it is not restricted to pcnet.
> This second system does not survive the network boot.
> 
> Up to now, I could not run tests with non-mips systems.
> 
> I'm fairly sure that 2 weeks ago networking worked without problems in both
> cases.
> 
What is your host CPU?  How you run qemu (what is your command line)?

> Regards
> Stefan Weil
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 0x7f3be89386e0 (LWP 14845)]
> 0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at
> ~/src/qemu/trunk/slirp/ip_input.c:408
> 408             ip->ip_len = next;
> (gdb) i s
> #0  0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at
> ~/src/qemu/trunk/slirp/ip_input.c:408
> #1  0x00000000004d15ad in ip_input (m=0x110e010) at
> ~/src/qemu/trunk/slirp/ip_input.c:228
> #2  0x00000000004b3d25 in slirp_input (pkt=0x12fcbd0 "RT", pkt_len=1294)
> at ~/src/qemu/trunk/slirp/slirp.c:679
> #3  0x000000000049a07d in qemu_send_packet (vc1=0x10ff440, buf=0x12fcbd0
> "RT", size=1294) at ~/src/qemu/trunk/net.c:399
> #4  0x000000000042ea6a in pcnet_transmit (s=0x12fc810) at
> ~/src/qemu/trunk/hw/pcnet.c:1300
> #5  0x000000000042ebd8 in pcnet_poll_timer (opaque=<value optimized
> out>) at ~/src/qemu/trunk/hw/pcnet.c:1363
> #6  0x000000000042f270 in pcnet_ioport_writew (opaque=0x7f3be72a79e0,
> addr=17884784, val=16684768)
>     at ~/src/qemu/trunk/hw/pcnet.c:1645
> #7  0x0000000000405eb8 in ioport_write (index=1, address=4146, data=0)
> at ~/src/qemu/trunk/vl.c:302
> #8  0x00000000004062b5 in cpu_outw (env=0x0, addr=4146, val=0) at
> ~/src/qemu/trunk/vl.c:432
> #9  0x00000000420ae755 in ?? ()
> #10 0x0000000000000000 in ?? ()
> (gdb) up
> #1  0x00000000004d15ad in ip_input (m=0x110e010) at
> ~/src/qemu/trunk/slirp/ip_input.c:228
> 228                             ip = ip_reass(ip, fp);
> (gdb) p ip
> $1 = (struct ip *) 0x110e060
> (gdb) do
> #0  0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at
> ~/src/qemu/trunk/slirp/ip_input.c:408
> 408             ip->ip_len = next;
> (gdb) p *ip
> Cannot access memory at address 0xfe96e0
> 
> 
> 

--
			Gleb.