From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=59869 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Ppz8N-0004Ul-64 for qemu-devel@nongnu.org; Thu, 17 Feb 2011 03:22:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Ppz8L-00019j-Lm for qemu-devel@nongnu.org; Thu, 17 Feb 2011 03:22:43 -0500 Received: from fmmailgate01.web.de ([217.72.192.221]:42285) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ppz8L-00019Y-6c for qemu-devel@nongnu.org; Thu, 17 Feb 2011 03:22:41 -0500 Message-ID: <4D5CDAC7.1030104@web.de> Date: Thu, 17 Feb 2011 09:22:31 +0100 From: Jan Kiszka MIME-Version: 1.0 Subject: Re: [Qemu-devel] Re: qemu crashes since today References: <4D5C4D4D.1020701@linux.vnet.ibm.com> <4D5C5370.6090908@web.de> <4D5C7B4E.4060002@linux.vnet.ibm.com> <4D5C9174.2070005@codemonkey.ws> In-Reply-To: <4D5C9174.2070005@codemonkey.ws> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enigDC0DFC4601F7D88B23698FAB" Sender: jan.kiszka@web.de List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Berger Cc: qemu-devel@nongnu.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigDC0DFC4601F7D88B23698FAB Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 2011-02-17 04:09, Anthony Liguori wrote: > On 02/16/2011 07:35 PM, Stefan Berger wrote: >> On 02/16/2011 05:45 PM, Jan Kiszka wrote: >>> On 2011-02-16 23:18, Stefan Berger wrote: >>>> Qemu is crashing for me. Bisecting the code I found this here as the= >>>> reason. Stepping one commit further into the past does not cause the= >>>> crash. >>>> >>>> 6792a57bf19ab37f61f5acf0f8e3003cf08814af is the first bad commit >>>> commit 6792a57bf19ab37f61f5acf0f8e3003cf08814af >>>> Author: Jan Kiszka >>>> Date: Mon Feb 7 12:19:18 2011 +0100 >>>> >>>> >>>> I get crashes while booting FC14 on a FC14 host, both 64bit. Host >>>> running 2.6.35.11-83.fc14 . Crashes typically happen when udev has >>>> stared in the guest. >>>> >>>> This is the command line I was using: >>>> >>>> ./x86_64-softmmu/qemu-system-x86_64 \ >>>> -hda ~images/fc14-x86_64.img \ >>>> -m 2048 \ >>>> -enable-kvm \ >>>> -boot menu=3Don \ >>>> -chardev stdio,id=3Dseabios \ >>>> -device isa-debugcon,iobase=3D0x402,chardev=3Dseabios >>>> >>> With our without --enable-io-thread? How does the crash look like, >>> specifically when caught by gdb (backtrace, variable states)? >> >> ./configure --target-list=3D"x86_64-softmmu" --enable-kvm >> >> the backtrace: >> >> Booting from Hard Disk... >> Booting from 0000:7c00 >> [New Thread 0x7fff51244700 (LWP 28825)] >> *** stack smashing detected ***: >> /home/stefanb/qemu/qemu-git/x86_64-softmmu/qemu >> -system-x86_64 terminated >> >> Program received signal SIGSEGV, Segmentation fault. >> 0x0000003883a0f09c in ?? () from /lib64/libgcc_s.so.1 >> (gdb) thread apply all bt >> >> Thread 2 (Thread 0x7fff51244700 (LWP 28825)): >> #0 0x00007ffff79c571e in pthread_cond_timedwait@@GLIBC_2.3.2 () >> from /lib64/libpthread.so.0 >> #1 0x000000000043b1eb in cond_timedwait (unused=3D) >> at posix-aio-compat.c:104 >> #2 aio_thread (unused=3D) at posix-aio-compat.c:= 325 >> #3 0x00007ffff79c0ccb in start_thread () from /lib64/libpthread.so.0 >> #4 0x00007ffff6a2cc2d in clone () from /lib64/libc.so.6 >> >> Thread 1 (Thread 0x7ffff7fc8820 (LWP 28818)): >> #0 0x0000003883a0f09c in ?? () from /lib64/libgcc_s.so.1 >> #1 0x0000003883a0fc59 in _Unwind_Backtrace () from /lib64/libgcc_s.so= =2E1 >> #2 0x00007ffff6a42520 in backtrace () from /lib64/libc.so.6 >> #3 0x00007ffff69bbd0f in __libc_message () from /lib64/libc.so.6 >> #4 0x00007ffff6a46127 in __fortify_fail () from /lib64/libc.so.6 >> #5 0x00007ffff6a460f0 in __stack_chk_fail () from /lib64/libc.so.6 >> #6 0x000000000042c669 in kvm_cpu_exec (env=3D0x1179310) >> at /home/stefanb/qemu/qemu-git/kvm-all.c:1005 >> #7 0x0000000000000001 in ?? () >> #8 0x000000000040bc18 in cpu_exec_all () >> at /home/stefanb/qemu/qemu-git/cpus.c:1097 >> #9 0x000000000056d914 in main_loop (argc=3D, >> argv=3D, envp=3D) >> at /home/stefanb/qemu/qemu-git/vl.c:1429 >> #10 main (argc=3D, argv=3D, >> envp=3D) at /home/stefanb/qemu/qemu-git/vl.c:= 3148 >> >> I have previously seen another backtrace, but having tried this now 5 >> times, this one keeps on coming back. >> >> This is one that I have seen previously: >> >> Program received signal SIGSEGV, Segmentation fault. >> 0x0000000001181345 in ?? () >> (gdb) bt >> #0 0x0000000001181345 in ?? () >> #1 0x0000000000564d58 in load_segment (selector1=3D) >> at /home/stefanb/qemu/qemu-git/target-i386/op_helper.c:149 >> #2 helper_verw (selector1=3D) >> at /home/stefanb/qemu/qemu-git/target-i386/op_helper.c:3411 >> #3 0x0000000000000000 in ?? () >> >> I hope this helps... >=20 > It's a 64-bit fedora 14 guest. I can't reproduce this with a grub1 or > grub2 Ubuntu guest or a Fedora 13 Live CD. >=20 > I haven't tried a F14 guest yet though. I suspect (not only because it's a more comfortable explanation :) ) the patch you bisected is only changing memory layouts to turn the stack smashing done elsewhere into a segfault. Does F14 happen to use the vmport/vmmount? Maybe this crash is related to [1]. Jan (who still can't reproduce this as well, even with all stack protections enabled) [1] http://article.gmane.org/gmane.comp.emulators.qemu/94132 --------------enigDC0DFC4601F7D88B23698FAB Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEUEARECAAYFAk1c2ssACgkQitSsb3rl5xT05wCWN/h7FPTdAPOkDjghkuLR85ur SgCdHqoaggkPV2OE5L2sVxEotniU94U= =9qzn -----END PGP SIGNATURE----- --------------enigDC0DFC4601F7D88B23698FAB--