From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:48627) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RwkYW-0003bB-K2 for qemu-devel@nongnu.org; Sun, 12 Feb 2012 20:18:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RwkYU-00085g-WA for qemu-devel@nongnu.org; Sun, 12 Feb 2012 20:18:12 -0500 Received: from mx1.redhat.com ([209.132.183.28]:12677) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RwkYU-00085Y-O0 for qemu-devel@nongnu.org; Sun, 12 Feb 2012 20:18:10 -0500 Date: Mon, 13 Feb 2012 03:18:13 +0200 From: "Michael S. Tsirkin" Message-ID: <20120213011813.GA8482@redhat.com> References: <20120212170743.GA3375@redhat.com> <20120212173140.GB3375@redhat.com> <4F37F910.5030400@codemonkey.ws> <20120212175659.GA4199@redhat.com> <4F381B4D.2000108@codemonkey.ws> <20120212201547.GC4199@redhat.com> <4F381EC7.3030407@codemonkey.ws> <20120213001735.GA8269@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120213001735.GA8269@redhat.com> Subject: Re: [Qemu-devel] weird qdev error List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: qemu-devel@nongnu.org On Mon, Feb 13, 2012 at 02:17:35AM +0200, Michael S. Tsirkin wrote: > On Sun, Feb 12, 2012 at 02:19:19PM -0600, Anthony Liguori wrote: > > On 02/12/2012 02:15 PM, Michael S. Tsirkin wrote: > > >On Sun, Feb 12, 2012 at 02:04:29PM -0600, Anthony Liguori wrote: > > >>On 02/12/2012 11:57 AM, Michael S. Tsirkin wrote: > > >>>On Sun, Feb 12, 2012 at 11:38:24AM -0600, Anthony Liguori wrote: > > >>>>From: Anthony Liguori > > >>>>Date: Sun, 12 Feb 2012 11:36:24 -0600 > > >>>>Subject: [PATCH] device_add: don't add a /peripheral link until init is complete > > >>>> > > >>>>Otherwise we end up with a dangling reference which causes qdev_free() to fail. > > >>>> > > >>>>Reported-by: Michael Tsirkin > > >>>>Signed-off-by: Anthony Liguori > > >>> > > >>>This handles the option parsing but what about hotplug > > >>>failures (when bus->hotplug returns an error)? > > >> > > >>Sorry, I don't follow. > > >> > > >>The assert you reported was that object_free() noted a reference > > >>count of !0 which indicates something else was holding the reference > > >>to the object. In this case, it was the child link in /peripheral. > > >> > > >>By delaying creating the link in /peripheral, we eliminate the problem completely. > > > > > >Th other problem was internal in pci which calls ->hostplug > > >during initialization. This doesn't seem affected? > > >But I didn't try, maybe I misundertand. > > > > Yeah, from qdev's perspective it's all just init failing. hotplug > > is entirely a PCI concept. > > > > > > > >>BTW, the explicit calls to do_pci_unregister are redundant. > > >>finalize() will be called during cleanup which means exit() will be > > >>invoked (which already calls do_pci_unregister). I'm not sure why > > >>this isn't failing more aggressively but it looks clearly wrong to > > >>me. > > >> > > >>Regards, > > >> > > >>Anthony Liguori > > > > > >Me too. Want to try to drop them? > > > > Yeah, I'll make this a two patch series. > > > > Regards, > > > > Anthony Liguori > > > I also see this: > > device_add virtio-net-pci,netdev=foo,mac=52:54:00:12:34:56,id=bla > device_del bla > *** glibc detected *** /home/mst/qemu-test/bin/qemu-system-x86_64: > corrupted double-linked list: 0x00007fae434565a0 *** > > Am I alone? > > Tried some tracing: I set breakpoint at g_free and gave the device_del command. (gdb) b g_free Breakpoint 3 at 0x7ffff73f55b0 (gdb) c Continuing. Program received signal SIGTSTP, Stopped (user). [Switching to Thread 0x7fffaf1a3700 (LWP 22749)] 0x00007ffff6ae074b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 (gdb) c Continuing. Program received signal SIGTSTP, Stopped (user). [Switching to Thread 0x7ffff4b28700 (LWP 22727)] 0x00007ffff6ae03cc in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 (gdb) continue Continuing. Program received signal SIGTSTP, Stopped (user). [Switching to Thread 0x7ffff7cb3700 (LWP 22712)] 0x00007ffff604c383 in select () from /lib64/libc.so.6 (gdb) continue Continuing. [Thread 0x7fffaf1a3700 (LWP 22749) exited] Breakpoint 3, 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 (gdb) continue Continuing. (qemu) device_del bla Breakpoint 3, 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 (gdb) where #0 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 #1 0x00007ffff7ec1d60 in monitor_parse_command (mon=0x7ffff8b207a0, cmdline=, qdict=0x7ffff9161660) at /home/mst/scm/qemu/monitor.c:3724 #2 0x00007ffff7ec2684 in handle_user_command (mon=0x7ffff8b207a0, cmdline= 0x7ffff8c86a30 "device_del bla") at /home/mst/scm/qemu/monitor.c:3803 #3 0x00007ffff7ec2b6e in monitor_command_cb (mon=0x7ffff8b207a0, cmdline=, opaque=) at /home/mst/scm/qemu/monitor.c:4436 #4 0x00007ffff7e463ed in readline_handle_byte (rs=0x7ffff8c86a30, ch=) at readline.c:370 #5 0x00007ffff7ec28b8 in monitor_read (opaque=, buf= 0x7fffffffce20 "\r\023\f\366\377\177", size=1) at /home/mst/scm/qemu/monitor.c:4422 #6 0x00007ffff7e313bb in qemu_chr_be_write (opaque=0x7ffff8b0ca00) at qemu-char.c:163 #7 fd_chr_read (opaque=0x7ffff8b0ca00) at qemu-char.c:587 #8 0x00007ffff7d7c967 in qemu_iohandler_poll (readfds=0x7fffffffdfb0, writefds= 0x7fffffffdf30, xfds=, ret=) at iohandler.c:121 #9 0x00007ffff7e1085f in main_loop_wait (nonblocking=) at main-loop.c:464 #10 0x00007ffff7e09284 in main_loop (argc=, argv=, envp=) at /home/mst/scm/qemu/vl.c:1482 #11 main (argc=, argv=, envp=) at /home/mst/scm/qemu/vl.c:3525 (gdb) frame 1 #1 0x00007ffff7ec1d60 in monitor_parse_command (mon=0x7ffff8b207a0, cmdline=, qdict=0x7ffff9161660) at /home/mst/scm/qemu/monitor.c:3724 3724 g_free(key); (gdb) p key $1 = 0x7ffff9166820 "id" (gdb) continue Continuing. Breakpoint 3, 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 (gdb) where #0 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 #1 0x00007ffff7e42fd4 in object_property_del (obj=0x7ffff8ca79d0, name=, errp=) at qom/object.c:629 #2 0x00007ffff7e4308d in object_property_del_child (obj=0x7ffff9123e50) at qom/object.c:310 #3 object_unparent (obj=0x7ffff9123e50) at qom/object.c:318 #4 0x00007ffff7de0a0d in pci_unplug_device (qdev=) at /home/mst/scm/qemu/hw/pci.c:1521 #5 0x00007ffff7ec26b5 in handle_user_command (mon=0x7ffff8b207a0, cmdline=) at /home/mst/scm/qemu/monitor.c:3813 #6 0x00007ffff7ec2b6e in monitor_command_cb (mon=0x7ffff8b207a0, cmdline=, opaque=) at /home/mst/scm/qemu/monitor.c:4436 #7 0x00007ffff7e463ed in readline_handle_byte (rs=0x7ffff8c86a30, ch=) at readline.c:370 #8 0x00007ffff7ec28b8 in monitor_read (opaque=, buf= 0x7fffffffce20 "\r\023\f\366\377\177", size=1) at /home/mst/scm/qemu/monitor.c:4422 #9 0x00007ffff7e313bb in qemu_chr_be_write (opaque=0x7ffff8b0ca00) at qemu-char.c:163 #10 fd_chr_read (opaque=0x7ffff8b0ca00) at qemu-char.c:587 #11 0x00007ffff7d7c967 in qemu_iohandler_poll (readfds=0x7fffffffdfb0, writefds= 0x7fffffffdf30, xfds=, ret=) at iohandler.c:121 #12 0x00007ffff7e1085f in main_loop_wait (nonblocking=) at main-loop.c:464 #13 0x00007ffff7e09284 in main_loop (argc=, argv=, envp=) at /home/mst/scm/qemu/vl.c:1482 #14 main (argc=, argv=, ---Type to continue, or q to quit--- envp=) at /home/mst/scm/qemu/vl.c:3525 (gdb) frame 1 #1 0x00007ffff7e42fd4 in object_property_del (obj=0x7ffff8ca79d0, name=, errp=) at qom/object.c:629 629 g_free(prop->name); (gdb) p prop->name $2 = (gchar *) 0x7ffff9164510 "bla" (gdb) continue Continuing. Breakpoint 3, 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 (gdb) frame 1 #1 0x00007ffff7e42fdd in object_property_del (obj=0x7ffff8ca79d0, name=, errp=) at qom/object.c:630 630 g_free(prop->type); (gdb) p prop->type $3 = (gchar *) 0x7ffff9164580 "child" (gdb) continue Continuing. Breakpoint 3, 0x00007ffff73f55b0 in g_free () from /lib64/libglib-2.0.so.0 (gdb) frame 1 #1 0x00007ffff7e4308d in object_property_del_child (obj=0x7ffff9123e50) at qom/object.c:310 310 object_property_del(obj, prop->name, errp); (gdb) p prop->name $4 = (gchar *) 0x7ffff9164510 "\020h\026\371\377\177" >>>>>>>>>>>>>>>>>>>>>>>>>>>> It seems clear that there is at least a use after free here. >>>>>>>>>>>>>>>>>>>>>>>>>>>> This is not an immediate source of the crash, however. -- MST