qemu-1.5.3 segment fault with -vga qxl

[john zhong]

execute " qemu-system-x86_64 -enable-kvm -machine accel=kvm:tcg -m 1G -drive file=/dev/sda --full-screen -spice addr=127.0.0.1,port=5900,disable-ticketing -vga qxl " on shell will get segment fault after a few seconds if I don't connect to it with spicec client immediately.

IF excute "spicec -h 127.0.0.1 -p 5900 " immediately !!!! after the qemu-system-x86_64 execution, then no segment fault happens and it runs well.

=====================

GDB output:

root@kali-john:~# gdb /usr/local/bin/qemu-system-x86_64
GNU gdb (GDB) 7.4.1-debian
(gdb) run -enable-kvm -machine accel=kvm:tcg -m 1G -drive file=/dev/sda --full-screen -spice addr=127.0.0.1,port=5900,disable-ticketing -vga qxl

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff3737700 (LWP 14797)]
[New Thread 0x7ffff2d54700 (LWP 14798)]
[New Thread 0x7ffff0fff700 (LWP 14799)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff683ad70 in pixman_image_get_data () from /usr/lib/x86_64-linux-gnu/libpixman-1.so.0
(gdb) bt
#0 0x00007ffff683ad70 in pixman_image_get_data () from /usr/lib/x86_64-linux-gnu/libpixman-1.so.0
#1 0x000055555581060a in surface_data (s=0x5555566183a0) at /zh-download/QEMU/qemu-1.5.3/include/ui/console.h:235
#2 0x0000555555818616 in vga_draw_graphic (s=0x55555662c778, full_update=1) at /zh-download/QEMU/qemu-1.5.3/hw/display/vga.c:1788
#3 0x0000555555818c6a in vga_update_display (opaque=0x55555662c778) at /zh-download/QEMU/qemu-1.5.3/hw/display/vga.c:1917
#4 0x000055555580eb15 in qxl_hw_update (opaque=0x55555662bd70) at /zh-download/QEMU/qemu-1.5.3/hw/display/qxl.c:1766
#5 0x00005555557bd6bc in graphic_hw_update (con=0x555556618d00) at ui/console.c:254
#6 0x00005555557c8426 in qemu_spice_display_refresh (ssd=0x55555662c418) at ui/spice-display.c:417
#7 0x000055555580eff0 in display_refresh (dcl=0x55555662c420) at /zh-download/QEMU/qemu-1.5.3/hw/display/qxl.c:1886
#8 0x00005555557c0cb1 in dpy_refresh (s=0x555556618370) at ui/console.c:1436
#9 0x00005555557bd3af in gui_update (opaque=0x555556618370) at ui/console.c:192
#10 0x0000555555797f20 in qemu_run_timers (clock=0x5555565b5a30) at qemu-timer.c:394
#11 0x0000555555798183 in qemu_run_all_timers () at qemu-timer.c:453
#12 0x0000555555760bb7 in main_loop_wait (nonblocking=0) at main-loop.c:470
#13 0x00005555557cd19c in main_loop () at vl.c:2029
#14 0x00005555557d43f2 in main (argc=13, argv=0x7fffffffe2b8, envp=0x7fffffffe328) at vl.c:4419
(gdb)

======================

http://www.spice-space.org/download/releases/spice-0.12.4.tar.bz2
http://www.spice-space.org/download/releases/spice-protocol-0.12.6.tar.bz2
spice compiling
      ./configure --enable-smartcard=no && make

qemu-1.5.3
compiling
    ./configure \
--disable-strip --enable-debug \
--target-list=x86_64-softmmu,x86_64-linux-user \
--disable-sdl --audio-drv-list=alsa --disable-vnc --disable-xen --disable-libiscsi \
 --disable-seccomp --disable-glusterfs --disable-libssh2 --disable-smartcard-nss \
 --disable-usb-redir --disable-brlapi --disable-curl --disable-bsd-user \
  \
--enable-kvm --enable-spice --enable-system --enable-guest-agent --enable-vhost-net

root@kali-john:~# qemu-system-x86_64 -version
QEMU emulator version 1.5.3, Copyright (c) 2003-2008 Fabrice Bellard

[john zhong (angel8cm)]

/usr/local/bin/qemu-system-x86_64 -enable-kvm -machine accel=kvm:tcg -m 1G -drive file=/dev/sda -vga qxl

will give same error

[john zhong (angel8cm)]

a funny thing:

if I change the "-drive file=/dev/sda" to "-drive file=/dev/sdb" , it will not run into "segment fault".

The different between sda & sdb is as following:
      linux is installed on /dev/sda and /dev/sdb is another physical hard driver.

=================================================================

When change /dev/sda to /dev/sdb , it works well as following:

(gdb) run -enable-kvm -machine accel=kvm:tcg -m 1G -drive file=/dev/sdb --full-screen -spice addr=127.0.0.1,port=5900,disable-ticketing -vga qxl
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /usr/local/bin/qemu-system-x86_64 -enable-kvm -machine accel=kvm:tcg -m 1G -drive file=/dev/sdb --full-screen -spice addr=127.0.0.1,port=5900,disable-ticketing -vga qxl
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff3737700 (LWP 15056)]
[New Thread 0x7ffff2d54700 (LWP 15057)]
[New Thread 0x7ffff0fff700 (LWP 15058)]
[Thread 0x7ffff3737700 (LWP 15056) exited]

--- No segment fault error any more !!

[john zhong (angel8cm)]

sorry to mistake

========

The truth is that

t will NOT run into segment fault with /dev/sda but without -vga qxl

The qemu & the Host linux OS is iinstalled on /dev/sda

[Thomas Huth (th-huth)]

Triaging old bug tickets ... QEMU 1.5 is quite old already - can you still reproduce the crash with the latest version of QEMU?

[Launchpad Janitor (janitor)]

[Expired for QEMU because there has been no activity for 60 days.]