From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53580) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZtbEA-00035B-4v for qemu-devel@nongnu.org; Tue, 03 Nov 2015 08:02:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZtbE6-0003SE-V2 for qemu-devel@nongnu.org; Tue, 03 Nov 2015 08:02:18 -0500 Received: from szxga01-in.huawei.com ([58.251.152.64]:52995) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZtbE6-0003Rr-7h for qemu-devel@nongnu.org; Tue, 03 Nov 2015 08:02:14 -0500 From: zhanghailiang Message-ID: <5638B041.50500@huawei.com> Date: Tue, 3 Nov 2015 21:01:53 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [vhost-user BUG ?] QEMU process segfault when shutdown or reboot with vhost-user List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "qemu-devel@nongnu.org" Cc: jasowang@redhat.com, peter.huangpeng@huawei.com, "stefanha@redhat.com" , mst@redhat.com Hi, We catch a segfault in our project. Qemu version is 2.3.0 The Stack backtrace is: (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007f7ad9280b2f in qemu_deliver_packet (sender=, flags=, data=, size=100, opaque= 0x7f7ad9d6db10) at net/net.c:510 #2 0x00007f7ad92831fa in qemu_net_queue_deliver (size=, data=, flags=, sender=, queue=) at net/queue.c:157 #3 qemu_net_queue_flush (queue=0x7f7ad9d39630) at net/queue.c:254 #4 0x00007f7ad9280dac in qemu_flush_or_purge_queued_packets (nc=0x7f7ad9d6db10, purge=true) at net/net.c:539 #5 0x00007f7ad9280e76 in net_vm_change_state_handler (opaque=, running=, state=100) at net/net.c:1214 #6 0x00007f7ad915612f in vm_state_notify (running=0, state=RUN_STATE_SHUTDOWN) at vl.c:1820 #7 0x00007f7ad906db1a in do_vm_stop (state=) at /usr/src/packages/BUILD/qemu-kvm-2.3.0/cpus.c:631 #8 vm_stop (state=RUN_STATE_SHUTDOWN) at /usr/src/packages/BUILD/qemu-kvm-2.3.0/cpus.c:1325 #9 0x00007f7ad915e4a2 in main_loop_should_exit () at vl.c:2080 #10 main_loop () at vl.c:2131 #11 main (argc=, argv=, envp=) at vl.c:4721 (gdb) p *(NetClientState *)0x7f7ad9d6db10 $1 = {info = 0x7f7ad9824520, link_down = 0, next = {tqe_next = 0x7f7ad0f06d10, tqe_prev = 0x7f7ad98b1cf0}, peer = 0x7f7ad0f06d10, incoming_queue = 0x7f7ad9d39630, model = 0x7f7ad9d39590 "vhost_user", name = 0x7f7ad9d39570 "hostnet0", info_str = "vhost-user to charnet0", '\000' , receive_disabled = 0, destructor = 0x7f7ad92821f0 , queue_index = 0, rxfilter_notify_enabled = 0} (gdb) p *(NetClientInfo *)0x7f7ad9824520 $2 = {type = NET_CLIENT_OPTIONS_KIND_VHOST_USER, size = 360, receive = 0, receive_raw = 0, receive_iov = 0, can_receive = 0, cleanup = 0x7f7ad9288850 , link_status_changed = 0, query_rx_filter = 0, poll = 0, has_ufo = 0x7f7ad92886d0 , has_vnet_hdr = 0x7f7ad9288670 , has_vnet_hdr_len = 0, using_vnet_hdr = 0, set_offload = 0, set_vnet_hdr_len = 0} (gdb) The corresponding codes where gdb reports error are: (We have added some codes in net.c) ssize_t qemu_deliver_packet(NetClientState *sender, unsigned flags, const uint8_t *data, size_t size, void *opaque) { NetClientState *nc = opaque; ssize_t ret; if (nc->link_down) { return size; } if (nc->receive_disabled) { return 0; } if (flags & QEMU_NET_PACKET_FLAG_RAW && nc->info->receive_raw) { ret = nc->info->receive_raw(nc, data, size); } else { ret = nc->info->receive(nc, data, size); ----> Here is 510 line } I'm not quite familiar with vhost-user, but for vhost-user, these two callback functions seem to be always NULL, Why we can come here ? Is it an error to add VM state change handler for vhost-user ? Thanks, zhanghailiang