qemu-io-test 147 segfaults when configured with gcov

Bug #1727250 reported by R.Nageswara Sastry
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Fix Released
Undecided
Murilo Opsfelder Araújo

Bug Description

Head is at 3d7196d43bfe12efe98568cb60057e273652b99b

Steps to re-produce:
1. git clone
./configure --enable-gcov --target-list=ppc64-softmmu
make
cd tests/qemu-iotests

2. export qemu binary, in my environment
export QEMU_PROG=/home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64

3. Run test 147 with format qcow2
./check -qcow2 147

QEMU -- "/home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64" -nodefaults -machine accel=qtest
QEMU_IMG -- "/home/nasastry/qemu/qemu-img"
QEMU_IO -- "/home/nasastry/qemu/qemu-io" --cache writeback -f qcow2
QEMU_NBD -- "/home/nasastry/qemu/qemu-nbd"
IMGFMT -- qcow2 (compat=1.1)
IMGPROTO -- file
PLATFORM -- Linux/ppc64le zzfp365-lp1 4.13.0-4.rel.git49564cb.el7.centos.ppc64le
TEST_DIR -- /home/nasastry/qemu/tests/qemu-iotests/scratch
SOCKET_SCM_HELPER -- /home/nasastry/qemu/tests/qemu-iotests/socket_scm_helper

147 0s ... [failed, exit status 1] - output mismatch (see 147.out.bad)
--- /home/nasastry/qemu/tests/qemu-iotests/147.out 2017-10-25 14:04:54.978600753 +0530
+++ /home/nasastry/qemu/tests/qemu-iotests/147.out.bad 2017-10-25 14:09:53.769783770 +0530
@@ -1,5 +1,95 @@
-......
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu/tests/qemu-iotests/scratch/qemu-28636-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest
+FFFFFF
+======================================================================
+FAIL: test_fd (__main__.BuiltinNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 203, in test_fd
+ self.client_test(filename, flatten_sock_addr(address), 'nbd-export')
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
+======================================================================
+FAIL: test_inet (__main__.BuiltinNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 146, in test_inet
+ flatten_sock_addr(address), 'nbd-export')
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
+======================================================================
+FAIL: test_inet6 (__main__.BuiltinNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 171, in test_inet6
+ self.client_test(filename, flatten_sock_addr(address), 'nbd-export')
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
+======================================================================
+FAIL: test_unix (__main__.BuiltinNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 179, in test_unix
+ flatten_sock_addr(address), 'nbd-export')
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
+======================================================================
+FAIL: test_inet (__main__.QemuNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 96, in test_inet
+ flatten_sock_addr(address))
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
+======================================================================
+FAIL: test_unix (__main__.QemuNBD)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "147", line 103, in test_unix
+ flatten_sock_addr(address))
+ File "147", line 55, in client_test
+ self.assert_qmp(result, 'return', {})
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 315, in assert_qmp
+ result = self.dictpath(d, path)
+ File "/home/nasastry/qemu/tests/qemu-iotests/iotests.py", line 274, in dictpath
+ self.fail('failed path traversal for "%s" in "%s"' % (path, str(d)))
+AssertionError: failed path traversal for "return" in "None"
+
 ----------------------------------------------------------------------
 Ran 6 tests

-OK
+FAILED (failures=6)
Failures: 147
Failed 1 of 1 tests

With out gcov configured, the above test get pass.
export QEMU_PROG=/home/nasastry/qemu/ppc64-softmmu/qemu-system-ppc64
./check -qcow2 147
QEMU -- "/home/nasastry/qemu/ppc64-softmmu/qemu-system-ppc64" -nodefaults -machine accel=qtest
QEMU_IMG -- "/home/nasastry/qemu/qemu-img"
QEMU_IO -- "/home/nasastry/qemu/qemu-io" --cache writeback -f qcow2
QEMU_NBD -- "/home/nasastry/qemu/qemu-nbd"
IMGFMT -- qcow2 (compat=1.1)
IMGPROTO -- file
PLATFORM -- Linux/ppc64le zzfp365-lp1 4.13.0-4.rel.git49564cb.el7.centos.ppc64le
TEST_DIR -- /home/nasastry/qemu/tests/qemu-iotests/scratch
SOCKET_SCM_HELPER -- /home/nasastry/qemu/tests/qemu-iotests/socket_scm_helper

147
Passed all 1 tests

Revision history for this message
R.Nageswara Sastry (nasastry) wrote :
Download full text (19.9 KiB)

from dmesg:
[81791.481930] qemu-system-ppc[28640]: unhandled signal 11 at 0000000000000004 nip 00007fff9f82f7d4 lr 0000000010e182fc code 30001
[81791.649081] qemu-system-ppc[28651]: unhandled signal 11 at 0000000000000004 nip 00007fffbd94f7d4 lr 0000000010e182fc code 30001
[81791.817591] qemu-system-ppc[28660]: unhandled signal 11 at 0000000000000004 nip 00007fff8c1ff7d4 lr 0000000010e182fc code 30001
[81791.994442] qemu-system-ppc[28669]: unhandled signal 11 at 0000000000000004 nip 00007fffa6f1f7d4 lr 0000000010e182fc code 30001
[81792.121339] qemu-system-ppc[28678]: unhandled signal 11 at 0000000000000004 nip 00007fffb9abf7d4 lr 0000000010e182fc code 30001
[81792.205728] qemu-system-ppc[28687]: unhandled signal 11 at 0000000000000004 nip 00007fff8dccf7d4 lr 0000000010e182fc code 30001

from gdb:
(gdb) bt
#0 0x00007fffa4a3f7d4 in __strcmp_power9 () from /lib64/libc.so.6
#1 0x0000000010e182fc in find_desc_by_name (desc=0x11304690, name=0x3dfce1b0 "server.str") at util/qemu-option.c:166
#2 0x0000000010e1d814 in qemu_opts_absorb_qdict (opts=0x3e25b1c0, qdict=0x3e0bbd40, errp=0x7fffd055c678) at util/qemu-option.c:1026
#3 0x0000000010c5b2d0 in nbd_open (bs=0x3dfcaee0, options=0x3e0bbd40, flags=24578, errp=0x7fffd055c760) at block/nbd.c:406
#4 0x0000000010b454d4 in bdrv_open_driver (bs=0x3dfcaee0, drv=0x11305010 <bdrv_nbd_unix>, node_name=0x0, options=0x3e0bbd40, open_flags=24578, errp=0x7fffd055c930) at block.c:1135
#5 0x0000000010b46af0 in bdrv_open_common (bs=0x3dfcaee0, file=0x0, options=0x3e0bbd40, errp=0x7fffd055c930) at block.c:1395
#6 0x0000000010b4ced4 in bdrv_open_inherit (filename=0x0, reference=0x0, options=0x3e0bbd40, flags=40962, parent=0x3dfc4be0, child_role=0x11004bd8 <child_file>, errp=0x7fffd055cb30) at block.c:2615
#7 0x0000000010b4b60c in bdrv_open_child_bs (filename=0x0, options=0x3dfc8ea0, bdref_key=0x11005870 "file", parent=0x3dfc4be0, child_role=0x11004bd8 <child_file>, allow_none=true, errp=0x7fffd055cb30) at block.c:2314
#8 0x0000000010b4c9ac in bdrv_open_inherit (filename=0x0, reference=0x0, options=0x3dfc8ea0, flags=8194, parent=0x0, child_role=0x0, errp=0x7fffd055cd48) at block.c:2566
#9 0x0000000010b4d6f8 in bdrv_open (filename=0x0, reference=0x0, options=0x3e261380, flags=0, errp=0x7fffd055cd48) at block.c:2697
#10 0x00000000105a4684 in bds_tree_init (bs_opts=0x3e261380, errp=0x7fffd055cd48) at blockdev.c:652
#11 0x00000000105b5c9c in qmp_blockdev_add (options=0x7fffd055cd58, errp=0x7fffd055cd48) at blockdev.c:3920
#12 0x00000000105eea88 in qmp_marshal_blockdev_add (args=0x3e25e320, ret=0x7fffd055cec0, errp=0x7fffd055ceb8) at qmp-marshal.c:616
#13 0x0000000010db4de0 in do_qmp_dispatch (cmds=0x1136b198 <qmp_commands>, request=0x3e25d300, errp=0x7fffd055cf30) at qapi/qmp-dispatch.c:104
#14 0x0000000010db518c in qmp_dispatch (cmds=0x1136b198 <qmp_commands>, request=0x3e25d300) at qapi/qmp-dispatch.c:131
#15 0x00000000100c9470 in handle_qmp_command (parser=0x3dfd3350, tokens=0x3dfbef40) at /home/nasastry/qemu/monitor.c:3854
#16 0x0000000010dc8bcc in json_message_process_token (lexer=0x3dfd3358, input=0x3dfbdc80, type=JSON_RCURLY, x=273, y=0) at qobject/json-streamer.c:105
#17 0x0000000010e3dc98 in json_lexer_f...

Revision history for this message
R.Nageswara Sastry (nasastry) wrote :
Download full text (3.2 KiB)

qemu-iotest 194 also fails in the similar stack trace.

# ./check -qcow2 194
QEMU -- "/home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64" -nodefaults -machine accel=qtest
QEMU_IMG -- "/home/nasastry/qemu_gcov/qemu-img"
QEMU_IO -- "/home/nasastry/qemu_gcov/qemu-io" --cache writeback -f qcow2
QEMU_NBD -- "/home/nasastry/qemu_gcov/qemu-nbd"
IMGFMT -- qcow2 (compat=1.1)
IMGPROTO -- file
PLATFORM -- Linux/ppc64le zzfp365-lp1 4.13.0-4.rel.git49564cb.el7.centos.ppc64le
TEST_DIR -- /home/nasastry/qemu_gcov/tests/qemu-iotests/scratch
SOCKET_SCM_HELPER -- /home/nasastry/qemu_gcov/tests/qemu-iotests/socket_scm_helper

194 1s ... [failed, exit status 1] - output mismatch (see 194.out.bad)
--- /home/nasastry/qemu_gcov/tests/qemu-iotests/194.out 2017-10-09 14:09:04.272726282 +0530
+++ /home/nasastry/qemu_gcov/tests/qemu-iotests/194.out.bad 2017-10-25 15:13:26.630139740 +0530
@@ -1,18 +1,18 @@
+WARNING:qemu:qemu received signal -11: /home/nasastry/qemu_gcov/ppc64-softmmu/qemu-system-ppc64 -chardev socket,id=mon,path=/home/nasastry/qemu_gcov/tests/qemu-iotests/scratch/qemusource-38326-monitor.sock -mon chardev=mon,mode=control -display none -vga none -qtest unix:path=/home/nasastry/qemu_gcov/tests/qemu-iotests/scratch/qemusource-38326-qtest.sock -machine accel=qtest -nodefaults -machine accel=qtest -drive if=virtio,id=drive0,file=/home/nasastry/qemu_gcov/tests/qemu-iotests/scratch/38326-source.img,format=qcow2,cache=writeback
 Launching VMs...
 Launching NBD server on destination...
 {u'return': {}}
 {u'return': {}}
 Starting `drive-mirror` on source...
-{u'return': {}}
+None
 Waiting for `drive-mirror` to complete...
-{u'timestamp': {u'seconds': 'SECS', u'microseconds': 'USECS'}, u'data': {u'device': u'mirror-job0', u'type': u'mirror', u'speed': 0, u'len': 1073741824, u'offset': 1073741824}, u'event': u'BLOCK_JOB_READY'}
-Starting migration...
-{u'return': {}}
-{u'timestamp': {u'seconds': 'SECS', u'microseconds': 'USECS'}, u'data': {u'status': u'setup'}, u'event': u'MIGRATION'}
-{u'timestamp': {u'seconds': 'SECS', u'microseconds': 'USECS'}, u'data': {u'status': u'active'}, u'event': u'MIGRATION'}
-{u'timestamp': {u'seconds': 'SECS', u'microseconds': 'USECS'}, u'data': {u'status': u'completed'}, u'event': u'MIGRATION'}
-Gracefully ending the `drive-mirror` job on source...
-{u'return': {}}
-{u'timestamp': {u'seconds': 'SECS', u'microseconds': 'USECS'}, u'data': {u'device': u'mirror-job0', u'type': u'mirror', u'speed': 0, u'len': 1073741824, u'offset': 1073741824}, u'event': u'BLOCK_JOB_COMPLETED'}
-Stopping the NBD server on destination...
-{u'return': {}}
+Traceback (most recent call last):
+ File "194", line 60, in <module>
+ iotests.log(source_vm.event_wait('BLOCK_JOB_READY'),
+ File "/home/nasastry/qemu_gcov/tests/qemu-iotests/../../scripts/qemu.py", line 319, in event_wait
+ event = self._qmp.pull_event(wait=timeout)
+ File "/home/nasastry/qemu_gcov/tests/qemu-iotests/../../scripts/qmp/qmp.py", line 216, in pull_event
+ self.__get_events(wait)
+ File "/home/nasastry/qemu_gcov/tests/qemu-iotests/../../scripts/qmp/qmp.py", line 128, in __get_events
+ raise QMPConnectError("Error while r...

Read more...

Revision history for this message
Murilo Opsfelder Araújo (mopsfelder) wrote :

I confirmed that my patch http://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00883.html fixes this bug too.

Changed in qemu:
assignee: nobody → Murilo Opsfelder Araújo (mopsfelder)
status: New → In Progress
Revision history for this message
Murilo Opsfelder Araújo (mopsfelder) wrote :

The fix was committed:

https://git.qemu.org/?p=qemu.git;a=commitdiff;h=c4365735a7d38f4355c6f77e6670d3972315f7c2

commit c4365735a7d38f4355c6f77e6670d3972315f7c2
Author: Murilo Opsfelder Araujo <email address hidden>
Date: Fri Jan 5 11:32:41 2018 -0200

    block/nbd: fix segmentation fault when .desc is not null-terminated

Changed in qemu:
status: In Progress → Fix Committed
Thomas Huth (th-huth)
Changed in qemu:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.