[pve-devel] [Qemu-devel] segfault in aio_bh_poll async.c:80 WAS: Re: kvm process disappears

[Stefan Hajnoczi]

On Tue, May 14, 2013 at 4:29 PM, Stefan Priebe - Profihost AG
<s.priebe at profihost.ag> wrote:
> Am 10.05.2013 13:09, schrieb Stefan Hajnoczi:
>> On Fri, May 10, 2013 at 11:07 AM, Stefan Priebe - Profihost AG
>> <s.priebe at profihost.ag> wrote:
>>> Am 10.05.2013 09:42, schrieb Stefan Hajnoczi:
>>>> On Fri, May 10, 2013 at 08:12:39AM +0200, Stefan Priebe - Profihost AG wrote:
>>>> 3. Either use gdb or an LD_PRELOAD library that catches exit(3) and
>>>>    _exit(2) and dumps core using abort(3).  Make sure core dumps are
>>>>    enabled.
>
> This time i had a segfault Qemu 1.4.1 plus
> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dc7588c1eb3008bda53dde1d6b890cd299758155.
>
> aio_bh_poll    async.c:80
>
> Code...
>
>    for (bh = ctx->first_bh; bh; bh = next) {
>         next = bh->next;
>         if (!bh->deleted && bh->scheduled) {
>             bh->scheduled = 0;
>             if (!bh->idle)
>                 ret = 1;
>             bh->idle = 0;
>             bh->cb(bh->opaque);
>         }
>     }
>
>     ctx->walking_bh--;
>
>     /* remove deleted bhs */
>     if (!ctx->walking_bh) {
>         bhp = &ctx->first_bh;
>         while (*bhp) {
>             bh = *bhp;
> ===== THIS IS THE SEGFAULT LINE =====            if (bh->deleted) {
>                 *bhp = bh->next;
>                 g_free(bh);
>             } else {
>                 bhp = &bh->next;
>             }
>         }
>     }
>
>     return ret;

Interesting crash.  Do you have the output of "thread apply all bt"?

I would try looking at the AioContext using "p *ctx", and print out
the ctx->first_bh linked list.

Stefan