[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] Re: qemu-kvm segfaults in qemu_del_timer (0.10.5 and 0.10.6

From: Avi Kivity
Subject: [Qemu-devel] Re: qemu-kvm segfaults in qemu_del_timer (0.10.5 and 0.10.6)
Date: Thu, 13 Aug 2009 15:42:38 +0300
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Lightning/1.0pre Thunderbird/3.0b2

On 08/13/2009 03:23 PM, Chris Webb wrote:
We've been lucky and relatively quickly got a core dump from one of the new
qemu-kvms with the non-zero core file rlimit. A backtrace looks like this:

   (gdb) bt
   #0  0x00000000004068f7 in qemu_mod_timer (ts=0x30d1f30, expire_time=430489)
       at /packages/qemu-kvm/src-f39tF1/vl.c:1161
   #1  0x0000000000495dd5 in vnc_update_client (opaque=<value optimized out>) 
at vnc.c:765
   #2  0x00000000004081da in main_loop_wait (timeout=<value optimized out>) at 
   #3  0x000000000051613a in kvm_main_loop () at 
   #4  0x000000000040c7b7 in main (argc=<value optimized out>, argv=<value optimized 
out>, envp=<value optimized out>)
       at /packages/qemu-kvm/src-f39tF1/vl.c:3850

The segfault appears to be a null pointer dereference. ts->clock is NULL
and line 1161 uses ts->clock->type:

   (gdb) p ts
   $4 = (QEMUTimer *) 0x30d1f30
   (gdb) p ts->clock
   $5 = (QEMUClock *) 0x0

The VncState in vnc_update_client is as follows:

   (gdb) f 1
   #1  0x0000000000495dd5 in vnc_update_client (opaque=<value optimized out>) 
at vnc.c:765
   765             qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + 
   (gdb) p *vs
   $12 = {timer = 0x30d1f30, csock = -986235208,

csock looks corrupted, should be -1 or an fd.  Was a vnc client connected?

Was the guest playing with the display resolution?

ds = 0x0, vd = 0x0, need_update = 1, dirty_row = {{0, 0, 4294967295,
         4294967295}<repeats 768 times>, {4294967295, 4294967295, 4294967295, 
4294967295}<repeats 1280 times>},
     old_data = 0x7f9b8276f010<Address 0x7f9b8276f010 out of bounds>,

old_data is also corrupted according to gdb, though it seems sane.

error compiling committee.c: too many arguments to function

reply via email to

[Prev in Thread] Current Thread [Next in Thread]