[Qemu-devel] [Bug 1307281] [NEW] qemu crash with assertion in usb_packet_complete_one

[huchaohong]

Public bug reported:

qemu release verison: 1.7.1
guest os : win7 32bits
qemu cmdline:
/usr/bin/qemu-system-x86_64 -name hch_test -S -machine 
pc-i440fx-1.7,accel=kvm,usb=off -cpu 
SandyBridge,+erms,+smep,+fsgsbase,+pdpe1gb,+rdrand,+f16c,+osxsave,+dca,+pcid,+pdcm,+xtpr,+tm2,+est,+smx,+vmx,+ds_cpl,+monitor,+dtes64,+pbe,+tm,+ht,+ss,+acpi,+ds,+vme
 -m 2048 -realtime mlock=off -smp 2,sockets=2,cores=12,threads=2 -uuid 
5ad433c9-e490-42f3-b365-c30d756fbd70 -no-user-config -nodefaults -chardev 
socket,id=charmonitor,path=/var/lib/libvirt/qemu/hch_test.monitor,server,nowait 
-mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime 
-no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=0 
-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device 
ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 
-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -drive 
file=/opt/cvm/hch_test/hch_test.inst,if=none,id=drive-virtio-disk0,format=qcow2,cache=writeback
 -device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
 -drive 
file=/opt/data/hugedisk/hch_test/hch_test_share.add,if=none,id=drive-virtio-disk1,format=qcow2,cache=writeback
 -device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk1,id=virtio-disk1
 -netdev tap,fd=26,id=hostnet0,vhost=on,vhostfd=27 -device 
virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:f2:05:b7,bus=pci.0,addr=0x3 
-chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 
-chardev spicevmc,id=charchannel0,name=vdagent -device 
virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0
 -chardev 
socket,id=charchannel1,path=/var/lib/libvirt/qemu/hch_test.agent,server,nowait 
-device 
virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=org.qemu.guest_agent.0
 -device usb-tablet,id=input0 -spice 
port=5903,addr=0.0.0.0,disable-ticketing,seamless-migration=on -device 
qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pci.0,addr=0x2 
-device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device 
hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -readconfig 
/etc/qemu/ich9-ehci-uhci.cfg -chardev 
spicevmc,name=usbredir,id=usbredirchardev1 -device 
usb-redir,chardev=usbredirchardev1,id=usbredirdev1,bus=ehci.0 -chardev 
spicevmc,name=usbredir,id=usbredirchardev2 -device 
usb-redir,chardev=usbredirchardev2,id=usbredirdev2,bus=ehci.0 -chardev 
spicevmc,name=usbredir,id=usbredirchardev3 -device 
usb-redir,chardev=usbredirchardev3,id=usbredirdev3,bus=ehci.0

i use spice to connect to vm and utilize usb redirection. i plug a
u-disk into a remote computer and start copy a big file (3G+) to u-disk
and qemu was crashed in the middle of the transmission.

i check the qemu log and found this log: "qemu-system-x86_64:
hw/usb/core.c:438: usb_packet_complete_one: Assertion `p->stream ||
((&ep->queue)->tqh_first) == p' failed". this crash can be reproduced
every time.

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1307281

Title:
  qemu crash with assertion in usb_packet_complete_one

Status in QEMU:
  New

Bug description:
  qemu release verison: 1.7.1
  guest os : win7 32bits
  qemu cmdline:
  /usr/bin/qemu-system-x86_64 -name hch_test -S -machine 
pc-i440fx-1.7,accel=kvm,usb=off -cpu 
SandyBridge,+erms,+smep,+fsgsbase,+pdpe1gb,+rdrand,+f16c,+osxsave,+dca,+pcid,+pdcm,+xtpr,+tm2,+est,+smx,+vmx,+ds_cpl,+monitor,+dtes64,+pbe,+tm,+ht,+ss,+acpi,+ds,+vme
 -m 2048 -realtime mlock=off -smp 2,sockets=2,cores=12,threads=2 -uuid 
5ad433c9-e490-42f3-b365-c30d756fbd70 -no-user-config -nodefaults -chardev 
socket,id=charmonitor,path=/var/lib/libvirt/qemu/hch_test.monitor,server,nowait 
-mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime 
-no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=0 
-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device 
ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 
-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -drive 
file=/opt/cvm/hch_test/hch_test.inst,if=none,id=drive-virtio-disk0,format=qcow2,cache=writeback
 -device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
 -drive 
file=/opt/data/hugedisk/hch_test/hch_test_share.add,if=none,id=drive-virtio-disk1,format=qcow2,cache=writeback
 -device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk1,id=virtio-disk1
 -netdev tap,fd=26,id=hostnet0,vhost=on,vhostfd=27 -device 
virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:f2:05:b7,bus=pci.0,addr=0x3 
-chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 
-chardev spicevmc,id=charchannel0,name=vdagent -device 
virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0
 -chardev 
socket,id=charchannel1,path=/var/lib/libvirt/qemu/hch_test.agent,server,nowait 
-device 
virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=org.qemu.guest_agent.0
 -device usb-tablet,id=input0 -spice 
port=5903,addr=0.0.0.0,disable-ticketing,seamless-migration=on -device 
qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pci.0,addr=0x2 
-device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device 
hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -readconfig 
/etc/qemu/ich9-ehci-uhci.cfg -chardev 
spicevmc,name=usbredir,id=usbredirchardev1 -device 
usb-redir,chardev=usbredirchardev1,id=usbredirdev1,bus=ehci.0 -chardev 
spicevmc,name=usbredir,id=usbredirchardev2 -device 
usb-redir,chardev=usbredirchardev2,id=usbredirdev2,bus=ehci.0 -chardev 
spicevmc,name=usbredir,id=usbredirchardev3 -device 
usb-redir,chardev=usbredirchardev3,id=usbredirdev3,bus=ehci.0

  i use spice to connect to vm and utilize usb redirection. i plug a
  u-disk into a remote computer and start copy a big file (3G+) to
  u-disk and qemu was crashed in the middle of the transmission.

  i check the qemu log and found this log: "qemu-system-x86_64:
  hw/usb/core.c:438: usb_packet_complete_one: Assertion `p->stream ||
  ((&ep->queue)->tqh_first) == p' failed". this crash can be reproduced
  every time.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1307281/+subscriptions