Crashes with kfreebsd guest when using KVM

[Nigel Horne]

commit 46411f863c26ff85c48b97939502007610c95398

Linux host
Kfreebsd guest
qemu -boot c -hda qemu_kfreebsd_i386.img -enable-kvm

QEMU crashes with free on invalid pointer:

*** glibc detected *** qemu: free(): invalid pointer: 0x000000000253cf60 ***
======= Backtrace: =========
/lib/libc.so.6(+0x71ad6)[0x7f0844fa5ad6]
qemu[0x494283]
qemu[0x4951ca]
qemu[0x49aa01]
qemu[0x495d15]
qemu[0x5197f4]
qemu[0x51a297]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7f0844f52c4d]
qemu[0x408799]
======= Memory map: ========
00400000-00625000 r-xp 00000000 08:06 4186599 /usr/local/bin/qemu
00825000-00847000 rw-p 00225000 08:06 4186599 /usr/local/bin/qemu
00847000-00fed000 rw-p 00000000 00:00 0
00fed000-00fee000 rwxp 00000000 00:00 0
00fee000-0104b000 rw-p 00000000 00:00 0
022fe000-023ff000 rw-p 00000000 00:00 0
023ff000-0240f000 rw-p 00000000 00:00 0
0240f000-0255d000 rw-p 00000000 00:00 0
41cd2000-43cd2000 rwxp 00000000 00:00 0
7f0835c22000-7f0835c38000 r-xp 00000000 08:06 3407959 /lib/libgcc_s.so.1
7f0835c38000-7f0835e37000 ---p 00016000 08:06 3407959 /lib/libgcc_s.so.1
7f0835e37000-7f0835e38000 rw-p 00015000 08:06 3407959 /lib/libgcc_s.so.1
7f0835e38000-7f0835e3d000 r-xp 00000000 08:06 4185228 /usr/lib/libXfixes.so.3.1.0
7f0835e3d000-7f083603c000 ---p 00005000 08:06 4185228 /usr/lib/libXfixes.so.3.1.0
7f083603c000-7f083603d000 rw-p 00004000 08:06 4185228 /usr/lib/libXfixes.so.3.1.0
7f083603d000-7f0836046000 r-xp 00000000 08:06 4178659 /usr/lib/libXcursor.so.1.0.2
7f0836046000-7f0836246000 ---p 00009000 08:06 4178659 /usr/lib/libXcursor.so.1.0.2
7f0836246000-7f0836247000 rw-p 00009000 08:06 4178659 /usr/lib/libXcursor.so.1.0.2
7f0836247000-7f0836294000 rw-p 00000000 00:00 0
7f083631c000-7f0836491000 r--p 00000000 08:06 3670017 /usr/lib/locale/locale-archive
7f0836491000-7f0836499000 r-xp 00000000 08:06 516333 /usr/lib/libXrandr.so.2.2.0
7f0836499000-7f0836698000 ---p 00008000 08:06 516333 /usr/lib/libXrandr.so.2.2.0
7f0836698000-7f0836699000 rw-p 00007000 08:06 516333 /usr/lib/libXrandr.so.2.2.0
7f0836699000-7f08366a2000 r-xp 00000000 08:06 4180666 /usr/lib/libXrender.so.1.3.0
7f08366a2000-7f08368a2000 ---p 00009000 08:06 4180666 /usr/lib/libXrender.so.1.3.0
7f08368a2000-7f08368a3000 rw-p 00009000 08:06 4180666 /usr/lib/libXrender.so.1.3.0
7f08368a3000-7f08368b4000 r-xp 00000000 08:06 4181769 /usr/lib/libXext.so.6.4.0
7f08368b4000-7f0836ab4000 ---p 00011000 08:06 4181769 /usr/lib/libXext.so.6.4.0
7f0836ab4000-7f0836ab5000 rw-p 00011000 08:06 4181769 /usr/lib/libXext.so.6.4.0
7f0836ad6000-7f0836ad7000 ---p 00000000 00:00 0
7f0836ad7000-7f0836f5b000 rw-p 00000000 00:00 0
7f0836f6e000-7f0837088000 rw-s 00000000 00:04 1900557 /SYSV00000000 (deleted)
7f0837088000-7f0837089000 rw-p 00000000 00:00 0
7f0837089000-7f0837889000 rw-p 00000000 00:00 0
7f0837889000-7f083788b000 rw-p 00000000 00:00 0
7f083788b000-7f083f88b000 rw-p 00000000 00:00 0
7f083f88b000-7f083f88c000 rw-p 00000000 00:00 0
7f083f88c000-7f083f88d000 ---p 00000000 00:00 0
7f083f88d000-7f0841a8f000 rw-p 00000000 00:00 0
7f0841a8f000-7f0841a94000 r-xp 00000000 08:06 4183916 /usr/lib/libXdmcp.so.6.0.0
7f0841a94000-7f0841c93000 ---p 00005000 08:06 4183916 /usr/lib/libXdmcp.so.6.0.0
7f0841c93000-7f0841c94000 rw-p 00004000 08:06 4183916 /usr/lib/libXdmcp.so.6.0.0
7f0841c94000-7f0841c96000 r-xp 00000000 08:06 4183879 /usr/lib/libXau.so.6.0.0
7f0841c96000-7f0841e96000 ---p 00002000 08:06 4183879 /usr/lib/libXau.so.6.0.0
7f0841e96000-7f0841e97000 rw-p 00002000 08:06 4183879 /usr/lib/libXau.so.6.0.0
7f0841e97000-7f0841eb6000 r-xp 00000000 08:06 3407929 /lib/libx86.so.1
7f0841eb6000-7f08420b6000 ---p 0001f000 08:06 3407929 /lib/libx86.so.1
7f08420b6000-7f08420b8000 rw-p 0001f000 08:06 3407929 /lib/libx86.so.1
7f08420b8000-7f08420b9000 rw-p 00000000 00:00 0
7f08420b9000-7f08420bc000 r-xp 00000000 08:06 4181768 /usr/lib/libgpg-error.so.0.4.0
7f08420bc000-7f08422bb000 ---p 00003000 08:06 4181768 /usr/lib/libgpg-error.so.0.4.0
7f08422bb000-7f08422bc000 rw-p 00002000 08:06 4181768 /usr/lib/libgpg-error.so.0.4.0
7f08422bc000-7f08422be000 r-xp 00000000 08:06 3407931 /lib/libkeyutils.so.1.3
7f08422be000-7f08424bd000 ---p 00002000 08:06 3407931 /lib/libkeyutils.so.1.3
7f08424bd000-7f08424be000 rw-p 00001000 08:06 3407931 /lib/libkeyutils.so.1.3
7f08424be000-7f08424c5000 r-xp 00000000 08:06 516340 /usr/lib/libkrb5support.so.0.1
7f08424c5000-7f08426c5000 ---p 00007000 08:06 516340 /usr/lib/libkrb5support.so.0.1
7f08426c5000-7f08426c6000 rw-p 00007000 08:06 516340 /usr/lib/libkrb5support.so.0.1
7f08426c6000-7f08426c9000 r-xp 00000000 08:06 3407916 /lib/libcom_err.so.2.1
7f08426c9000-7f08428c8000 ---p 00003000 08:06 3407916 /lib/libcom_err.so.2.1
7f08428c8000-7f08428c9000 rw-p 00002000 08:06 3407916 /lib/libcom_err.so.2.1
7f08428c9000-7f08428ee000 r-xp 00000000 08:06 4178134 /usr/lib/libk5crypto.so.3.1
7f08428ee000-7f0842aed000 ---p 00025000 08:06 4178134 /usr/lib/libk5crypto.so.3.1
7f0842aed000-7f0842aef000 rw-p 00024000 08:06 4178134 /usr/lib/libk5crypto.so.3.1
7f0842aef000-7f0842bad000 r-xp 00000000 08:06 516332 /usr/lib/libkrb5.so.3.3
7f0842bad000-7f0842dac000 ---p 000be000 08:06 516332 /usr/lib/libkrb5.so.3.3
7f0842dac000-7f0842db7000 rw-p 000bd000 08:06 516332 /usr/lib/libkrb5.so.3.3
7f0842db7000-7f0842dd0000 r-xp 00000000 08:06 516360 /usr/lib/libsasl2.so.2.0.23
7f0842dd0000-7f0842fcf000 ---p 00019000 08:06 516360 /usr/lib/libsasl2.so.2.0.23
7f0842fcf000-7f0842fd0000 rw-p 00018000 08:06 516360 /usr/lib/libsasl2.so.2.0.23
7f0842fd0000-7f0842fe3000 r-xp 00000000 08:06 3408041 /lib/libresolv-2.11.2.so

[Nigel Horne (njh-bandsman)]

Configure command used:

./configure --enable-linux-aio --enable-io-thread --enable-kvm

[Thomas Huth (th-huth)]

Triaging old bug tickets ... can you still reproduce this problem with the latest version of QEMU?

[Launchpad Janitor (janitor)]

[Expired for QEMU because there has been no activity for 60 days.]