Can you set a watchpoint for (*dev)->driver and see where it fires?
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1835466
Title:
qemu 4.0.0 abort()s in audio_get_pdo_in (poisoned drv->driver?)
Status in QEMU:
New
Bug description:
After upgrading qemu from 3.0.0 to 4.0.0 (compiled from release
tarball), I'm seeing a (reproducible) crash related to audio
subsystem.
I recompiled qemu with debugging options and got it to crash under
gdb:
Thread 6 "qemu-system-x86" received signal SIGABRT, Aborted.
0x00007ffff52e420b in raise () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff52e420b in raise () at /lib64/libc.so.6
#1 0x00007ffff52c6524 in abort () at /lib64/libc.so.6
#2 0x000000000041ec33 in audio_get_pdo_in (dev=<optimized out>) at
audio/audio_template.h:328
#3 0x00000000005d0123 in AUD_open_in
(card=0x7ffdde98dbc8, sw=0x7ffff17444e0, name=0x999d80 "adc",
callback_opaque=callback_opaque@entry=0x7ffdde98fd58, callback_fn=0x610940
<hda_audio_input_cb>, as=as@entry=0x7ffdde98fd84) at audio/audio_template.h:434
#4 0x000000000060fe2e in hda_audio_setup (st=0x7ffdde98fd58) at
hw/audio/hda-codec.c:490
#5 0x000000000061051b in hda_audio_command (hda=0x7ffdde98db40, nid=4,
data=<optimized out>) at hw/audio/hda-codec.c:590
#6 0x000000000060ea20 in intel_hda_send_command (d=d@entry=0x7ffff0a2fc00,
verb=verb@entry=4341777) at hw/audio/intel-hda.c:301
#7 0x000000000060ebbe in intel_hda_corb_run (d=<optimized out>) at
hw/audio/intel-hda.c:336
#8 0x000000000060ebbe in intel_hda_corb_run (d=0x7ffff0a2fc00) at
hw/audio/intel-hda.c:305
#9 0x0000000000495b99 in memory_region_write_accessor
(mr=mr@entry=0x7ffff0a307a0, addr=72, value=value@entry=0x7fffeddfe568,
size=size@entry=2, shift=<optimized out>, mask=mask@entry=65535, attrs=...)
at memory.c:502
#10 0x000000000049448e in access_with_adjusted_size
(addr=addr@entry=72, value=value@entry=0x7fffeddfe568, size=size@entry=2,
access_size_min=<optimized out>, access_size_max=<optimized out>,
access_fn=access_fn@entry=0x495b10 <memory_region_write_accessor>,
mr=0x7ffff0a307a0, attrs=...) at memory.c:568
#11 0x00000000004974f3 in memory_region_dispatch_write
(mr=mr@entry=0x7ffff0a307a0, addr=72, data=<optimized out>, size=2,
attrs=attrs@entry=...)
at memory.c:1496
#12 0x000000000042afbc in flatview_write_continue
(fv=fv@entry=0x7ffdd36ef5c0, addr=addr@entry=4228186184, attrs=...,
buf=buf@entry=0x7ffff66c7028 <incomplete sequence \311>, len=len@entry=2,
addr1=<optimized out>, l=<optimized out>, mr=0x7ffff0a307a0) at exec.c:3279
#13 0x000000000042b1d6 in flatview_write
(fv=0x7ffdd36ef5c0, addr=addr@entry=4228186184, attrs=attrs@entry=...,
buf=buf@entry=0x7ffff66c7028 <incomplete sequence \311>, len=len@entry=2)
at exec.c:3318
#14 0x000000000042e2a6 in address_space_write
(as=0xfc5080 <address_space_memory>, addr=4228186184, attrs=...,
buf=buf@entry=0x7ffff66c7028 <incomplete sequence \311>, len=2)
at exec.c:3408
#15 0x000000000042e33a in address_space_rw (as=<optimized out>,
addr=<optimized out>, attrs=...,
attrs@entry=..., buf=buf@entry=0x7ffff66c7028 <incomplete sequence \311>,
len=<optimized out>, is_write=<optimized out>) at exec.c:3419
#16 0x00000000004ac3c6 in kvm_cpu_exec (cpu=cpu@entry=0x7ffff0a81140) at
accel/kvm/kvm-all.c:2034
#17 0x00000000004812ae in qemu_kvm_cpu_thread_fn (arg=0x7ffff0a81140) at
cpus.c:1281
#18 0x00000000004812ae in qemu_kvm_cpu_thread_fn
(arg=arg@entry=0x7ffff0a81140) at cpus.c:1254
#19 0x000000000089d0eb in qemu_thread_start (args=<optimized out>) at
util/qemu-thread-posix.c:502
#20 0x00007ffff549319c in start_thread () at /lib64/libpthread.so.0
#21 0x00007ffff53ba4af in clone () at /lib64/libc.so.6
After some poking around, I think there's something overwriting dev->driver
so this switch(dev->driver) statement falls through to abort():
https://git.qemu.org/?p=qemu.git;a=blob;f=audio/audio_template.h;h=1232bb54db0e7073e60e3ccb72c1ed72cf5e3831;hb=131b9a05705636086699df15d4a6d328bb2585e8#l304
Here's why I think so:
$ export QEMU_AUDIO_DRV=pa
$ gdb /usr/bin/qemu-system-x86_64
(gdb) b qpa_audio_init
Breakpoint 1 at 0x79bcb0: file audio/paaudio.c, line 831.
(gdb) b audio_get_pdo_in
Breakpoint 2 at 0x5ce320: file audio/audio_template.h, line 304.
(gdb) run -enable-kvm -cpu Nehalem -machine q35 -device intel-iommu -name
Workstation -smp 4 -m 8G -soundhw hda -rtc base=localtime -drive
file=workstation-disk0.qcow2,if=virtio,format=qcow2 -drive
file=workstation-disk1.qcow2,if=virtio,format=qcow2 -net
nic,model=virtio,macaddr=aa:bb:cc:dd:ee:ff -net tap,ifname=tap42 -monitor
telnet:127.0.0.1:7043,server,nowait -pidfile workstation.pid -vga qxl -global
qxl-vga.vgamem_mb=64 -device usb-ehci,id=ehci -device
usb-host,vendorid=0x1390,productid=0x5454,bus=ehci.0 -device
usb-host,vendorid=0x054c,bus=ehci.0 -device usb-tablet -device
nec-usb-xhci,id=xhci -device
usb-host,vendorid=0x10c4,productid=0x888e,bus=xhci.0
Thread 1 "qemu-system-x86" hit Breakpoint 1, qpa_audio_init
(dev=0x7ffff161b6a0) at audio/paaudio.c:831
(gdb) p (*dev)->driver
$1 = AUDIODEV_DRIVER_PA
(gdb) p/d AUDIODEV_DRIVER_PA
$2 = 5
(gdb) cont
Continuing.
[Thread 0x7ffff09ff700 (LWP 4078) exited]
audio: warning: Using timer based audio emulation
Thread 1 "qemu-system-x86" hit Breakpoint 2, audio_get_pdo_in
(dev=0x7ffff161b6a0) at audio/audio_template.h:304
(gdb) p (*dev)->driver
$3 = AUDIODEV_DRIVER_PA
(gdb) cont
Continuing.
Thread 1 "qemu-system-x86" hit Breakpoint 2, audio_get_pdo_in
(dev=0x7ffff161b6a0) at audio/audio_template.h:304
(gdb) p (*dev)->driver
$4 = AUDIODEV_DRIVER_PA
(gdb) cont
Continuing.
Thread 1 "qemu-system-x86" hit Breakpoint 2, audio_get_pdo_in
(dev=0x7ffff161b6a0) at audio/audio_template.h:304
(gdb) p (*dev)->driver
$5 = AUDIODEV_DRIVER_PA
(gdb) cont
Continuing.
[New Thread 0x7ffff09ff700 (LWP 4483)]
[New Thread 0x7ffddcdff700 (LWP 4489)]
[New Thread 0x7ffddbdff700 (LWP 4490)]
[New Thread 0x7ffddb1ff700 (LWP 4491)]
[New Thread 0x7ffdd2dff700 (LWP 4494)]
[New Thread 0x7ffdd25fe700 (LWP 4495)]
[New Thread 0x7ffdd1dfd700 (LWP 4497)]
[New Thread 0x7ffdda5ff700 (LWP 4500)]
[New Thread 0x7ffdcedff700 (LWP 4501)]
qemu-system-x86_64: warning: guest updated active QH
[Switching to Thread 0x7fffef7ff700 (LWP 4097)]
Thread 4 "qemu-system-x86" hit Breakpoint 2, audio_get_pdo_in
(dev=0x7ffff161b6a0) at audio/audio_template.h:304
(gdb) p (*dev)->driver
$6 = 176
For what it's worth, guest is Fedora 29, host is a Slackware system with qemu
compiled (manually) with these options:
CFLAGS="-O2 -fPIC" \
CXXFLAGS="-O2 -fPIC" \
./configure \
--prefix=/usr --libdir=/usr/lib64 --sysconfdir=/etc --localstatedir=/var \
--enable-gtk \
--enable-system \
--enable-kvm \
--enable-virtfs \
--enable-sdl \
--enable-gnutls \
--enable-curses \
--enable-virtfs \
--enable-curl \
--enable-linux-aio \
--enable-vhost-net \
--enable-spice \
--enable-libusb \
--enable-usb-redir \
--enable-lzo \
--enable-bzip2 \
--enable-libssh2 \
--enable-numa \
--enable-jemalloc \
--enable-opengl \
--audio-drv-list=alsa,oss,sdl,pa \
--enable-vnc --enable-vnc-sasl --enable-vnc-png --enable-vnc-jpeg \
--target-list=i386-softmmu,x86_64-softmmu,i386-linux-user,x86_64-linux-user,arm-softmmu,arm-linux-user,armeb-linux-user,sparc64-softmmu,sparc-softmmu,sparc32plus-linux-user,sparc64-linux-user
\
--enable-debug --extra-cflags="-g3" --extra-ldflags="-g3" --disable-strip
--disable-pie # For debugging only
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1835466/+subscriptions
