QEMU

QEMU crashes when slow VNC client disconnects

Bug #1594861 reported by Mark Taylor
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Fix Released
Undecided
Unassigned

Bug Description

QEMU (at least 2.6.0 and today's git origin/master 6f1d2d1c5ad20d464705b17318cb7ca495f8078a) crashes when a slow VNC client disconnects during a time of busy VNC updates, with:
qemu_mutex_lock: Invalid argument

This is easily repeatable:
  - Start up a QEMU with the Finnix 1.10 CD-ROM, as below
  - vnclient host:0 -shared (remote X11-based vnc client, to make it "slow")
  - On the Finnix command line, run: "while :; do ls -laRC /; done" to generate screen updates
  - Close the vncclient
  - QEMU crashes on locking an already free'd mutex (note that the VNC state's share_mode is DISCONNECTED)

# gdb qemu-system-x86_64
GNU gdb (GDB) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from qemu-system-x86_64...done.
(gdb) run -cdrom finnix-110.iso -m 1G -vga cirrus -usbdevice tablet -net nic,model=e1000 -net user -rtc base=localtime,clock=host -enable-kvm -vnc :0,share=ignore -monitor stdio
Starting program: qemu-system-x86_64 -cdrom finnix-110.iso -m 1G -vga cirrus -usbdevice tablet -net nic,model=e1000 -net user -rtc base=localtime,clock=host -enable-kvm -vnc :0,share=ignore -monitor stdio
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7ffff1ca2700 (LWP 25717)]
Failed to initialize module: /usr/lib/qemu/block-dmg.so
Note: only modules from the same build can be loaded.
[New Thread 0x7ffff129d700 (LWP 25718)]
QEMU 2.6.50 monitor - type 'help' for more information
(qemu) [New Thread 0x7ffff08ba700 (LWP 25719)]
[New Thread 0x7fffaabff700 (LWP 25721)]
[Thread 0x7ffff129d700 (LWP 25718) exited]
[New Thread 0x7ffff129d700 (LWP 25724)]
[Thread 0x7ffff129d700 (LWP 25724) exited]
[New Thread 0x7ffff129d700 (LWP 25728)]
qemu: qemu_mutex_lock: Invalid argument

Thread 1 "qemu-system-x86" received signal SIGABRT, Aborted.
0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6
(gdb) thread apply all backtrace

Thread 7 (Thread 0x7ffff129d700 (LWP 25728)):
#0 0x00007ffff634b5f5 in do_futex_wait () from /usr/lib/libpthread.so.0
#1 0x00007ffff634b6bf in __new_sem_wait_slow () from /usr/lib/libpthread.so.0
#2 0x00007ffff634b772 in sem_timedwait () from /usr/lib/libpthread.so.0
#3 0x0000555555a7fcb7 in qemu_sem_timedwait (sem=sem@entry=0x555556518c38, ms=ms@entry=10000)
    at util/qemu-thread-posix.c:245
#4 0x00005555559f281c in worker_thread (opaque=0x555556518bd0) at thread-pool.c:92
#5 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0
#6 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6

Thread 5 (Thread 0x7fffaabff700 (LWP 25721)):
#0 0x00007ffff634903f in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1 0x0000555555a7fb69 in qemu_cond_wait (cond=cond@entry=0x555556541790, mutex=mutex@entry=0x5555565417c0)
    at util/qemu-thread-posix.c:123
#2 0x00005555559ecb4b in vnc_worker_thread_loop (queue=queue@entry=0x555556541790) at ui/vnc-jobs.c:228
#3 0x00005555559ed088 in vnc_worker_thread (arg=0x555556541790) at ui/vnc-jobs.c:335
#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0
#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6

Thread 4 (Thread 0x7ffff08ba700 (LWP 25719)):
#0 0x00007ffff4979277 in ioctl () from /usr/lib/libc.so.6
#1 0x00005555557d3484 in kvm_vcpu_ioctl (cpu=cpu@entry=0x55555651f2d0, type=type@entry=44672)
    at kvm-all.c:2057
#2 0x00005555557d353d in kvm_cpu_exec (cpu=cpu@entry=0x55555651f2d0)
    at kvm-all.c:1907
#3 0x00005555557c1ea4 in qemu_kvm_cpu_thread_fn (arg=0x55555651f2d0)
    at cpus.c:1078
#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0
#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6

Thread 2 (Thread 0x7ffff1ca2700 (LWP 25717)):
#0 0x00007ffff497c7f9 in syscall () from /usr/lib/libc.so.6
#1 0x0000555555a7fe75 in futex_wait (val=<optimized out>, ev=<optimized out>) at util/qemu-thread-posix.c:292
#2 qemu_event_wait (ev=ev@entry=0x55555646bb64 <rcu_call_ready_event>) at util/qemu-thread-posix.c:399
#3 0x0000555555a8e26e in call_rcu_thread (opaque=<optimized out>) at util/rcu.c:250
#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0
#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7ffff7f94a80 (LWP 25713)):
#0 0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6
#1 0x00007ffff48cd72a in abort () from /usr/lib/libc.so.6
#2 0x000055555579290b in error_exit (err=<optimized out>,
    msg=msg@entry=0x555555b59d30 <__func__.14707> "qemu_mutex_lock") at util/qemu-thread-posix.c:39
#3 0x0000555555a7faa0 in qemu_mutex_lock (mutex=mutex@entry=0x555556566568) at util/qemu-thread-posix.c:66
#4 0x00005555559da91f in vnc_lock_output (vs=0x55555655a320) at ui/vnc-jobs.h:62
#5 vnc_client_write (vs=0x55555655a320) at ui/vnc.c:1361
#6 vnc_client_io (ioc=<optimized out>, condition=<optimized out>, opaque=0x55555655a320) at ui/vnc.c:1483
#7 0x00007ffff53a6dba in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#8 0x00005555559fa6eb in glib_pollfds_poll () at main-loop.c:213
#9 os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:258
#10 main_loop_wait (nonblocking=<optimized out>) at main-loop.c:506
#11 0x00005555557974a4 in main_loop () at vl.c:1925
#12 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4628
(gdb) thread 1
[Switching to thread 1 (Thread 0x7ffff7f94a80 (LWP 25713))]
#0 0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6
(gdb) frame 5
#5 vnc_client_write (vs=0x55555655a320) at ui/vnc.c:1361
1361 vnc_lock_output(vs);
(gdb) set max-value-size 80000
(gdb) print *vs
$1 = {sioc = 0x555557b1da40, ioc = 0x555557998790, ioc_tag = 0, disconnecting = 0, dirty = {{0, 0, 0}, {0, 0, 0}, {
      1055221925019647, 0, 0}, {1055221925019647, 0, 0}, {773781307523071, 0, 0}, {1125899906842623, 0, 0}, {
      1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {
      1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {71193947300417, 0, 0}, {71193947300433, 0, 0}, {
      71193947300417, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1319379593592831, 0, 0}, {1319379593592831, 0, 0}, {
      1319379593592831, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {
      2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {
      106275268473665, 0, 0}, {115071496237889, 0, 0}, {106275268473665, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {
      381680068419649535, 0, 0}, {381680068419649535, 0, 0}, {309622474381721599, 0, 0}, {576460752303423487, 0, 0}, {
      576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {
      576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {106194469454161, 0, 0}, {36285762154894705, 0, 0}, {
      106194469454161, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {307370399690129407, 0, 0}, {307370399690129407, 0, 0},
    {307370399690129407, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {
      569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {
      55615324492583, 0, 0}, {36225287405246247, 0, 0}, {55615324492583, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {
      451468244688044031, 0, 0}, {451468244688044031, 0, 0}, {451468244688044031, 0, 0}, {569705352862367743, 0, 0}, {
      569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {
      569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {55546325181303, 0, 0}, {36154780942280567, 0, 0}, {
      55546325181303, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {3406691643129069567, 0, 0}, {3406691643129069567, 0,
      0}, {3406691643129069567, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407,
      0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {
      4607182418800017407, 0, 0}, {432929977792532287, 0, 0}, {541438925046353727, 0, 0}, {432929977792532287, 0, 0}, {
      0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {2831620673523154943, 0, 0}, {2831620673523154943, 0, 0}, {2831620673523154943,
      0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {
      4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0,
      0}, {721827755353776959, 0, 0}, {830336702607599423, 0, 0}, {721827755353776959, 0, 0}, {0, 0, 0}, {0, 0, 0}, {
      0, 0, 0}, {1543608686381891327, 0, 0}, {1543608686381891327, 0, 0}, {1543045736428470271, 0, 0}, {
      4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0,
      0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {721970826084188599,
      0, 0}, {253878283546232247, 0, 0}, {145510073780765111, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {
      1517695344798859263, 0, 0}, {1517695344798859263, 0, 0}, {1515461137171218431, 0, 0}, {4580160821035794431, 0,
      0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431,
      0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {226043368113417, 0, 0}, {72565387932009739, 0,
      0}, {226043368113417, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1522216674051227647, 0, 0}, {1522216674051227647,
      0, 0}, {1517713074423857151, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, {
      2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0,
      0}, {2278821411449470975, 0, 0}, {638357209941807, 0, 0}, {73127235220875119, 0, 0}, {638357209941807, 0, 0}, {
      0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1873497444986126335, 0, 0}, {1873497444986126335, 0, 0}, {1873497376266649599,
      0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {
      4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0,
      0}, {36244873060242763, 0, 0}, {115366073929258319, 0, 0}, {36244873060242763, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0,
      0, 0}, {1125899872482361343, 0, 0}, {1125899872482361343, 0, 0}, {1125899735043407871, 0, 0}, {
      2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0,
      0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {325521969941073283,
      0, 0}, {397861314371603915, 0, 0}, {325521969941073283, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {
      1121396238495776767, 0, 0}, {1121396238495776767, 0, 0}, {1121396307215253503, 0, 0}, {1143914305352105983, 0,
      0}, {1143914305352105983, 0, 0}, {1143914305352105983, 0, 0}...}, lossy_rect = 0x555557b1da50,
  vd = 0x5555585000a0, need_update = 1, force_update = 0, has_dirty = 192431, features = 723, absolute = 1,
  last_x = 512, last_y = 384, last_bmask = 0, client_width = 1024, client_height = 768,
  share_mode = VNC_SHARE_MODE_DISCONNECTED, vnc_encoding = 7, major = 3, minor = 8, auth = 1, subauth = 0,
  challenge = '\000' <repeats 15 times>, tls = 0x0, encode_ws = false, websocket = false, info = 0x555557976a30,
  output = {name = 0x0, capacity = 0, offset = 0, avg_size = 4194304, buffer = 0x0}, input = {name = 0x0,
    capacity = 0, offset = 0, avg_size = 524288, buffer = 0x0}, write_pixels = 0x5555559daae0 <vnc_write_pixels_copy>,
  client_pf = {bits_per_pixel = 32 ' ', bytes_per_pixel = 4 '\004', depth = 24 '\030', rmask = 16711680,
    gmask = 65280, bmask = 255, amask = 0, rshift = 16 '\020', gshift = 8 '\b', bshift = 0 '\000', ashift = 24 '\030',
    rmax = 255 '\377', gmax = 255 '\377', bmax = 255 '\377', amax = 0 '\000', rbits = 8 '\b', gbits = 8 '\b',
    bbits = 8 '\b', abits = 0 '\000'}, client_format = 0, client_be = false, audio_cap = 0x0, as = {freq = 44100,
    nchannels = 2, fmt = AUD_FMT_S16, endianness = 0}, read_handler = 0x5555559dbdc0 <protocol_client_msg>,
  read_handler_expect = 1, modifiers_state = '\000' <repeats 255 times>, led = 0x5555572f5c40, abort = false,
  initialized = true, output_mutex = {lock = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0,
        __kind = -1, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}},
      __size = '\000' <repeats 16 times>, "\377\377\377\377", '\000' <repeats 19 times>, __align = 0}},
  bh = 0x555557929d00, jobs_buffer = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, tight = {
    type = 7, quality = 255 '\377', compression = 9 '\t', pixel24 = 1 '\001', tight = {name = 0x0, capacity = 0,
      offset = 0, avg_size = 1890052, buffer = 0x0}, tmp = {name = 0x7fff9c0d3830 "vnc-worker-output",
      capacity = 32768, offset = 26162, avg_size = 4194304, buffer = 0x555557786540 "\330R\303\364\377\177"}, zlib = {
      name = 0x0, capacity = 0, offset = 0, avg_size = 524288, buffer = 0x0}, gradient = {name = 0x0, capacity = 0,
      offset = 0, avg_size = 0, buffer = 0x0}, jpeg = {name = 0x0, capacity = 0, offset = 0, avg_size = 0,
      buffer = 0x0}, png = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, levels = {9, 9, 9, 0},
    stream = {{next_in = 0x7fff9c1341f0 "", avail_in = 0, total_in = 282144,
        next_out = 0x7fff9c0640fd "\256\022\352]\002\210n\021rg\b\271\v\204\334\361\001", avail_out = 4083,
        total_out = 40323, msg = 0x0, state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>,
        zfree = 0x5555559deb50 <vnc_zlib_zfree>, opaque = 0x7fffaabec3f0, data_type = 0, adler = 1422910222,
        reserved = 0}, {next_in = 0x7fff9c134210 "", avail_in = 0, total_in = 3212411,
        next_out = 0x7fff9c0640f9 "\377\235&\344\256\022\352]\002\210n\021rg\b\271\v\204\334\361\001",
        avail_out = 4087, total_out = 1563572, msg = 0x0, state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>,
        zfree = 0x5555559deb50 <vnc_zlib_zfree>, opaque = 0x7fffaabec3f0, data_type = 0, adler = 2665424950,
        reserved = 0}, {next_in = 0x7fff9c134440 "", avail_in = 0, total_in = 1057759,
        next_out = 0x7fff9c064148 ">E\025\322fI \220\262\320\322\024", avail_out = 4008, total_out = 83411, msg = 0x0,
        state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>, zfree = 0x5555559deb50 <vnc_zlib_zfree>,
        opaque = 0x7fffaabec3f0, data_type = 0, adler = 3032660148, reserved = 0}, {next_in = 0x0, avail_in = 0,
        total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, zalloc = 0x0, zfree = 0x0,
        opaque = 0x0, data_type = 0, adler = 0, reserved = 0}}}, zlib = {zlib = {name = 0x0, capacity = 0, offset = 0,
      avg_size = 0, buffer = 0x0}, tmp = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, stream = {
      next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0,
      zalloc = 0x0, zfree = 0x0, opaque = 0x0, data_type = 0, adler = 0, reserved = 0}, level = 0}, hextile = {
    send_tile = 0x5555559df670 <send_hextile_tile_32>}, zrle = {type = 0, fb = {name = 0x0, capacity = 0, offset = 0,
      avg_size = 0, buffer = 0x0}, zrle = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, tmp = {
      name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, zlib = {name = 0x0, capacity = 0, offset = 0,
      avg_size = 0, buffer = 0x0}, stream = {next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0,
      total_out = 0, msg = 0x0, state = 0x0, zalloc = 0x0, zfree = 0x0, opaque = 0x0, data_type = 0, adler = 0,
      reserved = 0}, palette = {pool = {{idx = 0, color = 0, next = {le_next = 0x0,
            le_prev = 0x0}} <repeats 256 times>}, size = 0, max = 0, bpp = 0, table = {{
          lh_first = 0x0} <repeats 256 times>}}}, zywrle = {buf = {0 <repeats 4096 times>}}, mouse_mode_notifier = {
    notify = 0x5555559db450 <check_pointer_type_change>, node = {le_next = 0x0,
      le_prev = 0x5555560586f8 <mouse_mode_notifiers>}}, next = {tqe_next = 0x0, tqe_prev = 0x5555585000a0}}

QEMU build config:

Install prefix /usr
BIOS directory /usr/share/qemu
binary directory /usr/bin
library directory /usr/lib
module directory /usr/lib/qemu
libexec directory /usr/lib/qemu
include directory /usr/include
config directory /etc
local state directory /var
Manual directory /usr/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path /home/me/build/qemu/src/qemu-git
C compiler cc
Host C compiler cc
C++ compiler c++
Objective-C compiler cc
ARFLAGS rv
CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -g -march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fPIC
QEMU_CFLAGS -I/usr/include/pixman-1 -Werror -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong -I/usr/include/libpng16 -I/usr/include/spice-server -I/usr/include/cacard -I/usr/include/nss -I/usr/include/nspr -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/pixman-1 -I/usr/include/spice-1 -I/usr/include/libusb-1.0
LDFLAGS -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g -Wl,-O1,--sort-common,--as-needed,-z,relro
make make
install install
python /usr/bin/python2 -B
smbd /usr/sbin/smbd
module support yes
host CPU x86_64
host big endian no
target list x86_64-softmmu i386-softmmu
tcg debug enabled no
gprof enabled no
sparse enabled no
strip binaries yes
profiler no
static build no
pixman system
SDL support yes (1.2.15)
GTK support no
GTK GL support no
VTE support no
GNUTLS support no
GNUTLS hash no
GNUTLS rnd no
libgcrypt no
libgcrypt kdf no
nettle no
nettle kdf no
libtasn1 yes
curses support yes
virgl support no
curl support no
mingw32 support no
Audio drivers sdl
Block whitelist (rw)
Block whitelist (ro)
VirtFS support no
VNC support yes
VNC SASL support no
VNC JPEG support yes
VNC PNG support yes
xen support no
brlapi support no
bluez support no
Documentation yes
PIE yes
vde support yes
netmap support no
Linux AIO support yes
ATTR/XATTR support yes
Install blobs yes
KVM support yes
RDMA support no
TCG interpreter no
fdt support no
preadv support yes
fdatasync yes
madvise yes
posix_madvise yes
uuid support yes
libcap-ng support yes
vhost-net support yes
vhost-scsi support yes
Trace backends nop
spice support yes (0.12.10/0.12.6)
rbd support no
xfsctl support yes
smartcard support no
libusb yes
usb net redir no
OpenGL support no
OpenGL dmabufs no
libiscsi support no
libnfs support no
build guest agent no
QGA VSS support no
QGA w32 disk info no
QGA MSI support no
seccomp support yes
coroutine backend ucontext
coroutine pool yes
GlusterFS support no
Archipelago support no
gcov gcov
gcov enabled no
TPM support yes
libssh2 support no
TPM passthrough yes
QOM debugging yes
vhdx no
lzo support no
snappy support no
bzip2 support no
NUMA host support yes
tcmalloc support no
jemalloc support no
avx2 optimization yes

Revision history for this message
Daniel Berrange (berrange) wrote :

The only place we free the mutex is in vnc_disconnect_finish() which is only ever called from vnc_client_read(), in turn called from vnc_client_io().

We're crashing in vnc_client_write() which is called from vnc_client_io().

The stack trace has optimized out the "condition" param in vnc_client_io(), but what I'm guessing is that vnc_client_io() is invoked with both G_IO_OUT and G_IO_IN set. We process G_IO_IN, calling vnc_disconnect_finish, and then carry on to process G_IO_OUT. It looks like we need to skip the G_IO_OUT processing if we called vnc_disconnect_finish during G_IO_IN handling

Revision history for this message
Daniel Berrange (berrange) wrote :

Potential fix posted

https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg07693.html

If you are able to test with this patch any feedback would be welcome.

Revision history for this message
Thomas Huth (th-huth) wrote :

Fix has been included in QEMU v2.7.0:
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=ea697449884d83b83fefb

Changed in qemu:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.