[Qemu-devel] Crash with odd chardev setup

[Dr. David Alan Gilbert]

Hi Dan,
  I've got a crash in head (and 2.10) which is a bit of a heisenbug;
I can trigger it with:

./qemu-system-x86_64 -netdev tap,id=hostnet0,vhost=on,fd=10   -chardev 
socket,id=charchannel0,path=/tmp/org.qemu.guest_agent.0,server,nowait  -monitor 
stdio -vnc :0

and then 'q' to quit.

Note I'm not doing a redirect in of fd 10.
It goes away if I remove either the -netdev or the -chardev option.

It doesn't trigger under gdb, but fortunately we get a core:

#0  0x000055a226d94a2e in socket_listen_cleanup (fd=<optimized out>, 
address@hidden)
    at /root/qemu/util/qemu-sockets.c:1077
    1077            if (addr->type == SOCKET_ADDRESS_TYPE_UNIX
    1078                && addr->u.q_unix.path) {
    1079                if (unlink(addr->u.q_unix.path) < 0 && errno != ENOENT) 
{

#1  0x000055a226d4242b in qio_channel_socket_finalize (obj=<optimized out>) at 
/root/qemu/io/channel-socket.c:388
#2  0x000055a226cbca92 in object_unref (type=<optimized out>, 
obj=0x55a2290ab400) at /root/qemu/qom/object.c:462
#3  0x000055a226cbca92 in object_unref (data=0x55a2290ab400) at 
/root/qemu/qom/object.c:476
#4  0x000055a226cbca92 in object_unref (obj=0x55a2290ab400) at 
/root/qemu/qom/object.c:911
#5  0x000055a226d334c9 in char_socket_finalize (obj=<optimized out>) at 
/root/qemu/chardev/char-socket.c:805
#6  0x000055a226cbca92 in object_unref (type=<optimized out>, 
obj=0x55a2290aa7f0) at /root/qemu/qom/object.c:462
#7  0x000055a226cbca92 in object_unref (data=0x55a2290aa7f0) at 
/root/qemu/qom/object.c:476
#8  0x000055a226cbca92 in object_unref (obj=0x55a2290aa7f0) at 
/root/qemu/qom/object.c:911
#9  0x000055a226cbcacc in object_unref (obj=0x55a2290ab7a0) at 
/root/qemu/qom/object.c:413
#10 0x000055a226cbcacc in object_unref (data=0x55a2290ab7a0) at 
/root/qemu/qom/object.c:475
#11 0x000055a226cbcacc in object_unref (obj=0x55a2290ab7a0) at 
/root/qemu/qom/object.c:911
#12 0x000055a226cbba87 in object_property_del_child (obj=0x55a22909e770, 
child=0x55a2290ab7a0, errp=0x0)
    at /root/qemu/qom/object.c:436
#13 0x000055a226cbc2e4 in object_unparent (obj=<optimized out>) at 
/root/qemu/qom/object.c:455
#14 0x000055a226d2e7e5 in qemu_chr_cleanup () at /root/qemu/chardev/char.c:1090
#15 0x000055a2269c73ff in main (argc=<optimized out>, argv=<optimized out>, 
envp=<optimized out>)
    at /root/qemu/vl.c:4914

Dave

--
Dr. David Alan Gilbert / address@hidden / Manchester, UK