[Qemu-devel] Segfault using qemu-system-arm in smc91c111

[Richard Purdie]

We're seeing repeated segfaults in qemu-system-arm when we heavily use
the network. I have a coredump backtrace:

Reading symbols from 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/sysroots/x86_64-linux/usr/bin/qemu-system-arm...done.
[New LWP 4536]
[New LWP 4534]
[New LWP 4530]
[New LWP 4537]
[New LWP 6396]

warning: Corrupted shared library list: 0x7f8d5f27e540 != 0x6198225000007f8d
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by 
`/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  smc91c111_pop_tx_fifo_done (s=0x7f8d6158b560)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:179
179             s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
(gdb) bt
#0  smc91c111_pop_tx_fifo_done (s=0x7f8d6158b560)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:179
#1  smc91c111_writeb (opaque=0x7f8d6158b560, offset=12, value=<optimized out>)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:431
#2  0x00007f8d5ecacd65 in memory_region_oldmmio_write_accessor (mr=<optimized 
out>, addr=<optimized out>, value=<optimized out>, 
    size=<optimized out>, shift=<optimized out>, mask=<optimized out>, 
attrs=...)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:434
#3  0x00007f8d5ecac5dd in access_with_adjusted_size (addr=140245200319840, 
address@hidden, value=0xc, address@hidden, 
    size=1, access_size_min=2031671516, access_size_max=32, 
access=0x7f8d5ecacd30 <memory_region_oldmmio_write_accessor>, 
    mr=0x7f8d6158f8f0, attrs=...)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506
#4  0x00007f8d5ecae08b in memory_region_dispatch_write (address@hidden, 
addr=12, data=2, address@hidden, 
    address@hidden)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171
#5  0x00007f8d5ec7b78f in address_space_rw (as=0x7f8d5f408600 
<address_space_memory>, addr=268501004, attrs=..., 
    address@hidden "\002", len=1, address@hidden)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2451
#6  0x00007f8d5ec7b9e0 in address_space_write (len=<optimized out>, 
buf=0x7f8d52ac64b0 "\002", attrs=..., addr=<optimized out>, 
    as=<optimized out>)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2521
#7  subpage_write (opaque=<optimized out>, addr=<optimized out>, 
value=<optimized out>, len=<optimized out>, attrs=...)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2081
#8  0x00007f8d5ecac5dd in access_with_adjusted_size (addr=140245200319840, 
address@hidden, value=0xc, address@hidden, 
    size=1, access_size_min=2031671516, access_size_max=32, 
access=0x7f8d5ecac500 <memory_region_write_with_attrs_accessor>, 
    mr=0x7f8d618d5750, attrs=...)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506
#9  0x00007f8d5ecae08b in memory_region_dispatch_write (mr=0x7f8d618d5750, 
addr=12, data=2, size=1, attrs=...)
    at 
/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-arm-lsb/build/build/tmp/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171
#10 0x00007f8d5584b512 in ?? ()

(gdb) print s->tx_fifo_done
$1 = {99614720, 99614720, 99614720, 99614720}
(gdb) print s->tx_fifo_done_len
$2 = 99614719

so it looks like tx_fifo_done_len has been corrupted, going beyond that
is harder for me to figure out. Does anyone happen to know what might be
going on here? This is with qemu 2.4.0.

Cheers,

Richard