From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54346) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WsZdw-0005nV-55 for qemu-devel@nongnu.org; Thu, 05 Jun 2014 11:31:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WsZdq-0000jh-OD for qemu-devel@nongnu.org; Thu, 05 Jun 2014 11:31:52 -0400 Received: from mail-ob0-x232.google.com ([2607:f8b0:4003:c01::232]:54784) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WsZdq-0000jd-In for qemu-devel@nongnu.org; Thu, 05 Jun 2014 11:31:46 -0400 Received: by mail-ob0-f178.google.com with SMTP id va2so1309656obc.9 for ; Thu, 05 Jun 2014 08:31:45 -0700 (PDT) MIME-Version: 1.0 Date: Thu, 5 Jun 2014 17:31:45 +0200 Message-ID: From: Stefan Hajnoczi Content-Type: text/plain; charset=UTF-8 Subject: [Qemu-devel] Use-after-free during unrealize in system_reset List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel Cc: =?UTF-8?Q?Andreas_F=C3=A4rber?= , "Michael S. Tsirkin" qemu-iotests ./check -qcow2 067 is entering an infinite loop during system_reset. This failure is a non-deterministic use-after-free and the infinite loop happens maybe 1/3 of the time. Michael Tsirkin found that pci_unregister_device() is called before pci_find_capability_list() since the parent is destroyed before the child. Looks like a qdev/qom issue. Any takers? Thread 1 (Thread 0x7fd9104fda80 (LWP 11716)): #0 pci_find_capability_list (pdev=0x7fd912e94fc0, prev_p=, cap_id=17 '\021') at hw/pci/pci.c:1839 #1 pci_del_capability (pdev=pdev@entry=0x7fd912e94fc0, cap_id=cap_id@entry=17 '\021', size=size@entry=12 '\f') at hw/pci/pci.c:2079 #2 0x00007fd9106d8e46 in msix_uninit (dev=0x7fd912e94fc0, table_bar=0x7fd912e953b0, pba_bar=0x7fd912e953b0) at hw/pci/msix.c:357 #3 0x00007fd9106d8f13 in msix_uninit_exclusive_bar (dev=0x7fd912e94fc0) at hw/pci/msix.c:377 #4 0x00007fd9107e6dcf in virtio_device_unrealize (dev=0x7fd912e958a8, errp=0x7fff20cb8370) at /home/stefanha/qemu/hw/virtio/virtio.c:1199 #5 0x00007fd910692f93 in device_set_realized (obj=, value=, errp=0x0) at hw/core/qdev.c:847 #6 0x00007fd910761c2e in property_set_bool (obj=0x7fd912e958a8, v=, opaque=0x7fd912e96ad0, name=, errp=0x0) at qom/object.c:1421 #7 0x00007fd9107641b7 in object_property_set_qobject (obj=obj@entry=0x7fd912e958a8, value=value@entry=0x7fd912e6bd70, name=name@entry=0x7fd9108a9a3a "realized", errp=errp@entry=0x0) at qom/qom-qobject.c:24 #8 0x00007fd910763090 in object_property_set_bool (obj=obj@entry=0x7fd912e958a8, value=value@entry=false, name=name@entry=0x7fd9108a9a3a "realized", errp=errp@entry=0x0) at qom/object.c:883 #9 0x00007fd910691958 in device_unparent (obj=0x7fd912e958a8) at hw/core/qdev.c:946 #10 0x00007fd910762d41 in object_unparent (obj=0x7fd912e958a8) at qom/object.c:400 #11 0x00007fd910691db8 in bus_unparent (obj=) at hw/core/qdev.c:547 #12 0x00007fd910762d41 in object_unparent (obj=0x7fd912e95830) at qom/object.c:400 #13 0x00007fd910691809 in device_unparent (obj=0x7fd912e94fc0) at hw/core/qdev.c:950 #14 0x00007fd910762d41 in object_unparent (obj=0x7fd912e94fc0) at qom/object.c:400 #15 0x00007fd91066b7b6 in acpi_pcihp_eject_slot (s=s@entry=0x7fd912e8e048, bsel=bsel@entry=0, slots=) at hw/acpi/pcihp.c:139 #16 0x00007fd91066b862 in acpi_pcihp_update_hotplug_bus (bsel=0, s=0x7fd912e8e048) at hw/acpi/pcihp.c:152 #17 acpi_pcihp_update (s=0x7fd912e8e048) at hw/acpi/pcihp.c:176 #18 acpi_pcihp_reset (s=0x7fd912e8e048) at hw/acpi/pcihp.c:182 #19 0x00007fd910797abd in qemu_devices_reset () at vl.c:1893 ---Type to continue, or q to quit--- #20 qemu_system_reset (report=) at vl.c:1906 #21 0x00007fd91060bfaf in main_loop_should_exit () at vl.c:2041 #22 main_loop () at vl.c:2081 #23 main (argc=, argv=, envp=) at vl.c:4565 Thread 2 (Thread 0x7fd8f9c83700 (LWP 11722)): #0 __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135 #1 0x00007fd90deea59c in _L_cond_lock_789 () from /lib64/libpthread.so.0 #2 0x00007fd90deea431 in __pthread_mutex_cond_lock (mutex=0x7fd9110f6c00 ) at ../nptl/pthread_mutex_lock.c:79 #3 0x00007fd90dee4db0 in pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:259 #4 0x00007fd9108837f9 in qemu_cond_wait (cond=, mutex=mutex@entry=0x7fd9110f6c00 ) at util/qemu-thread-posix.c:135 #5 0x00007fd91079c8d8 in qemu_tcg_cpu_thread_fn (arg=) at /home/stefanha/qemu/cpus.c:943 #6 0x00007fd90dee0f33 in start_thread (arg=0x7fd8f9c83700) at pthread_create.c:309 #7 0x00007fd906b23ded in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111