[Qemu-devel] [Bug] QEMU crashed with latest qemu master tree code

[Gonglei (Arei)]

Hi,

Command line:

#./qemu-system-x86_64 -enable-kvm -m 2048 -machine q35 -device 
ide-drive,bus=ide.2,drive=MacHDD \
-drive id=MacHDD,if=none,file=/mnt/sdb/gonglei/image/redhat_q35.img -monitor 
stdio -vnc :10 -readconfig ../docs/q35-chipset.cfg
(qemu) Segmentation fault (core dumped)

Some clews:

1. the bad commit is 0e4a77370594c91dd126f9872893ed473374cc72
2. if I do not add command line argument '-readconfig ../docs/q35-chipset.cfg 
', it works well.
3. backtrace as below:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff257c700 (LWP 27649)]
0x00005555558b4ad3 in object_class_dynamic_cast (class=0x555556523720, 
typename=0x5555559ba852 "cpu") at qom/object.c:502
502         if (type->name == typename) {
(gdb) p *type
Cannot access memory at address 0x0
(gdb) bt
#0  0x00005555558b4ad3 in object_class_dynamic_cast (class=0x555556523720, 
typename=0x5555559ba852 "cpu") at qom/object.c:502
#1  0x00005555558b485a in object_dynamic_cast (obj=0x55555643abe0, 
typename=0x5555559ba852 "cpu") at qom/object.c:443
#2  0x00005555556a4ee3 in acpi_add_cpu_info (o=0x55555643abe0, 
opaque=0x7ffff257b930) at /home/new/qemu/hw/i386/acpi-build.c:133
#3  0x00005555558b50fa in object_child_foreach (obj=0x5555563e8770, 
fn=0x5555556a4eac <acpi_add_cpu_info>, opaque=0x7ffff257b930)
    at qom/object.c:676
#4  0x00005555556a4f4b in acpi_add_cpu_info (o=0x5555563e8770, 
opaque=0x7ffff257b930) at /home/new/qemu/hw/i386/acpi-build.c:140
#5  0x00005555558b50fa in object_child_foreach (obj=0x5555562efa40, 
fn=0x5555556a4eac <acpi_add_cpu_info>, opaque=0x7ffff257b930)
    at qom/object.c:676
#6  0x00005555556a4f4b in acpi_add_cpu_info (o=0x5555562efa40, 
opaque=0x7ffff257b930) at /home/new/qemu/hw/i386/acpi-build.c:140
#7  0x00005555558b50fa in object_child_foreach (obj=0x5555562d26a0, 
fn=0x5555556a4eac <acpi_add_cpu_info>, opaque=0x7ffff257b930)
    at qom/object.c:676
#8  0x00005555556a4f4b in acpi_add_cpu_info (o=0x5555562d26a0, 
opaque=0x7ffff257b930) at /home/new/qemu/hw/i386/acpi-build.c:140
#9  0x00005555558b50fa in object_child_foreach (obj=0x5555562d5770, 
fn=0x5555556a4eac <acpi_add_cpu_info>, opaque=0x7ffff257b930)
    at qom/object.c:676
#10 0x00005555556a5024 in acpi_get_cpu_info (cpu=0x7ffff257b930) at 
/home/new/qemu/hw/i386/acpi-build.c:149
#11 0x00005555556a8bb7 in acpi_build (guest_info=0x555556309880, 
tables=0x7ffff257b980) at /home/new/qemu/hw/i386/acpi-build.c:1486
#12 0x00005555556a90cd in acpi_build_update (build_opaque=0x5555564353b0, 
offset=0) at /home/new/qemu/hw/i386/acpi-build.c:1623
#13 0x0000555555826373 in fw_cfg_read (s=0x55555630d010) at 
hw/nvram/fw_cfg.c:255
#14 0x0000555555826565 in fw_cfg_comb_read (opaque=0x55555630d010, addr=1, 
size=1) at hw/nvram/fw_cfg.c:291
#15 0x0000555555645f52 in memory_region_read_accessor (mr=0x55555630f4f0, 
addr=1, value=0x7ffff257bb10, size=1, shift=0, mask=255)
    at /home/new/qemu/memory.c:410
#16 0x000055555564624c in access_with_adjusted_size (addr=1, 
value=0x7ffff257bb10, size=1, access_size_min=1, access_size_max=4, 
    access=0x555555645ef4 <memory_region_read_accessor>, mr=0x55555630f4f0) at 
/home/new/qemu/memory.c:480
#17 0x0000555555649651 in memory_region_dispatch_read1 (mr=0x55555630f4f0, 
addr=1, size=1) at /home/new/qemu/memory.c:1096
#18 0x0000555555649709 in memory_region_dispatch_read (mr=0x55555630f4f0, 
addr=1, pval=0x7ffff257bc00, size=1)
    at /home/new/qemu/memory.c:1118
#19 0x000055555564d325 in io_mem_read (mr=0x55555630f4f0, addr=1, 
pval=0x7ffff257bc00, size=1) at /home/new/qemu/memory.c:1961
#20 0x00005555555f7bfe in address_space_rw (as=0x555555df6d20 
<address_space_io>, addr=1297, buf=0x7ffff7ff3000 "&", len=1, 
    is_write=false) at /home/new/qemu/exec.c:2086
#21 0x00005555556429d6 in kvm_handle_io (port=1297, data=0x7ffff7ff3000, 
direction=0, size=1, count=1024)
    at /home/new/qemu/kvm-all.c:1597
#22 0x0000555555642f7a in kvm_cpu_exec (cpu=0x5555562f3060) at 
/home/new/qemu/kvm-all.c:1734
#23 0x000055555562a4d8 in qemu_kvm_cpu_thread_fn (arg=0x5555562f3060) at 
/home/new/qemu/cpus.c:939
#24 0x00007ffff572a7f6 in start_thread () from /lib64/libpthread.so.0
#25 0x00007ffff548609d in clone () from /lib64/libc.so.6
#26 0x0000000000000000 in ?? ()
(gdb) p *class
$2 = {type = 0x0, interfaces = 0x21 = {<error reading variable>
(gdb)

Best regards,
-Gonglei