QMP (32 bit only) segfaults in query-tpm-types when compiled with --enable-tpm
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
NB: This bug ONLY happens on i686. When qemu is compiled for x86-64, the bug does NOT happen.
$ ./configure --enable-tpm
$ make
$ (sleep 5; printf '{"execute"
{"QMP": {"version": {"qemu": {"micro": 50, "minor": 6, "major": 1}, "package": ""}, "capabilities": []}}
{"return": {}}
Segmentation fault (core dumped)
The stack trace is:
#0 output_type_enum (v=0xb9938228, obj=0x5,
strings=
errp=
#1 0xb762b3b5 in visit_type_enum (v=v@entry=
strings=
name=
at qapi/qapi-
#2 0xb74a9ef4 in visit_type_TpmType (errp=0xbfec4628, name=0x0,
obj=<optimized out>, m=0xb9938228) at qapi-visit.c:5220
#3 visit_type_
name=
at qapi-visit.c:5206
#4 0xb74c403e in qmp_marshal_
ret_
#5 qmp_marshal_
ret=0xbfec46d8) at qmp-marshal.c:3817
#6 0xb7581d7a in qmp_call_cmd (cmd=<optimized out>, params=0xb99379a0,
mon=0xb9937098) at /home/rjones/
#7 handle_qmp_command (parser=0xb99370ec, tokens=0xb9941438)
at /home/rjones/
#8 0xb7631d8f in json_message_
token=
at qobject/
#9 0xb764579b in json_lexer_
ch=<optimized out>, flush=flush@
#10 0xb76458c8 in json_lexer_feed (lexer=
buffer=
at qobject/
#11 0xb7631fab in json_message_
buffer=
at qobject/
#12 0xb75803eb in monitor_
buf=0xbfec486c "}\243\
#13 0xb74b191e in qemu_chr_be_write (len=<optimized out>,
buf=0xbfec486c "}\243\
#14 fd_chr_read (chan=0xb9935870, cond=(G_IO_IN | G_IO_HUP), opaque=0xb9935800)
at qemu-char.c:841
#15 0xb71f6876 in g_io_unix_dispatch () from /usr/lib/
#16 0xb71b0286 in g_main_
#17 0xb747a13e in glib_pollfds_poll () at main-loop.c:189
#18 os_host_
#19 main_loop_wait (nonblocking=1) at main-loop.c:484
#20 0xb7309f11 in main_loop () at vl.c:2090
#21 main (argc=8, argv=0xbfec5c14, envp=0xbfec5c38) at vl.c:4435
Looks like the fix has been included here: git.qemu. org/?p= qemu.git; a=commitdiff; h=02dc4bf5684d3 fb46786
http://
... so closing this ticket now.