From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=45964 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PxDxz-0003b0-S5 for qemu-devel@nongnu.org; Wed, 09 Mar 2011 02:37:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PxDxy-0003KB-LC for qemu-devel@nongnu.org; Wed, 09 Mar 2011 02:37:55 -0500 Received: from fmmailgate02.web.de ([217.72.192.227]:54618) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PxDxy-0003Jt-7W for qemu-devel@nongnu.org; Wed, 09 Mar 2011 02:37:54 -0500 Message-ID: <4D772E4C.6020604@web.de> Date: Wed, 09 Mar 2011 08:37:48 +0100 From: Jan Kiszka MIME-Version: 1.0 References: <2640D58E-2101-47FA-99B6-28815666651E@dlh.net> In-Reply-To: <2640D58E-2101-47FA-99B6-28815666651E@dlh.net> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig0389340D2EB6074E91F29D23" Sender: jan.kiszka@web.de Subject: [Qemu-devel] Re: segmentation fault in qemu-kvm-0.14.0 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Lieven Cc: qemu-devel , kvm@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig0389340D2EB6074E91F29D23 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 2011-03-08 23:53, Peter Lieven wrote: > Hi, >=20 > during testing of qemu-kvm-0.14.0 i can reproduce the following segfaul= t. i have seen similar crash already in 0.13.0, but had no time to debug.= > my guess is that this segfault is related to the threaded vnc server wh= ich was introduced in qemu 0.13.0. the bug is only triggerable if a vnc > client is attached. it might also be connected to a resolution change i= n the guest. i have a backtrace attached. the debugger is still running i= f someone > needs more output >=20 =2E.. > Thread 1 (Thread 0x7ffff7ff0700 (LWP 29038)): > #0 0x0000000000000000 in ?? () > No symbol table info available. > #1 0x000000000041d669 in main_loop_wait (nonblocking=3D0) > at /usr/src/qemu-kvm-0.14.0/vl.c:1388 So we are calling a IOHandlerRecord::fd_write handler that is NULL. Looking at qemu_set_fd_handler2, this may happen if that function is called for an existing io-handler entry with non-NULL write handler, passing a NULL write and a non-NULL read handler. And all this without the global mutex held. And there are actually calls in vnc_client_write_plain and vnc_client_write_locked (in contrast to vnc_write) that may generate this pattern. It's probably worth validating that the iothread lock is always held when qemu_set_fd_handler2 is invoked to confirm this race theory, adding something like assert(pthread_mutex_trylock(&qemu_mutex) !=3D 0); (that's for qemu-kvm only) BTW, qemu with just --enable-vnc-thread, ie. without io-thread support, should always run into this race as it then definitely lacks a global mut= ex. Jan --------------enig0389340D2EB6074E91F29D23 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk13Lk8ACgkQitSsb3rl5xRTDwCgqXMx2Vp0Nc9Q7f7Er3iiJy8i cPgAoKwz5KQpwSxf2P6kAU7+/iAYFk5g =eq+R -----END PGP SIGNATURE----- --------------enig0389340D2EB6074E91F29D23--