[Qemu-devel] [Bug 1570134] Re: While committing snapshot qemu crashes with SIGABRT

[Matthew Schumacher]

Sure, I did the same test and still got a SIGABRT, but the debug looks a
little different:

Backtrace:

#0  0x00007f8f0d46a3f8 in raise () at /lib64/libc.so.6
#1  0x00007f8f0d46bffa in abort () at /lib64/libc.so.6
#2  0x00007f8f0d462c17 in __assert_fail_base () at /lib64/libc.so.6
#3  0x00007f8f0d462cc2 in  () at /lib64/libc.so.6
#4  0x000055ff4ce33926 in mirror_run (s=0x55ff4fc00dd0) at block/mirror.c:335
        next_sector = 31174784
        next_chunk = 243553
        nb_chunks = 29
        end = 209715200
        sectors_per_chunk = 128
        source = 0x55ff4e1eb050
        sector_num = 31171072
        delay_ns = 0
        delay_ns = 0
        cnt = 157184
        should_complete = <optimized out>
        s = 0x55ff4fc00dd0
        data = <optimized out>
        bs = 0x55ff4e1eb050
        sector_num = <optimized out>
        end = <optimized out>
        length = <optimized out>
        last_pause_ns = <optimized out>
        bdi = {cluster_size = 65536, vm_state_offset = 107374182400, is_dirty = 
false, unallocated_blocks_are_zero = true, can_write_zeroes_with_unmap = true, 
needs_compressed_writes = false}
        backing_filename = "\000\021"
        ret = <optimized out>
        n = 1048576
        target_cluster_size = <optimized out>
        __PRETTY_FUNCTION__ = "mirror_run"
#5  0x000055ff4ce33926 in mirror_run (opaque=0x55ff4fc00dd0) at 
block/mirror.c:613
        delay_ns = 0
        cnt = 157184
        should_complete = <optimized out>
        s = 0x55ff4fc00dd0
        data = <optimized out>
        bs = 0x55ff4e1eb050
        sector_num = <optimized out>
        end = <optimized out>
        length = <optimized out>
        last_pause_ns = <optimized out>
        bdi = {cluster_size = 65536, vm_state_offset = 107374182400, is_dirty = 
false, unallocated_blocks_are_zero = true, can_write_zeroes_with_unmap = true, 
needs_compressed_writes = false}
        backing_filename = "\000\021"
        ret = <optimized out>
        n = 1048576
        target_cluster_size = <optimized out>
        __PRETTY_FUNCTION__ = "mirror_run"
#6  0x000055ff4ce9968a in coroutine_trampoline (i0=<optimized out>, 
i1=<optimized out>) at util/coroutine-ucontext.c:78
        self = 0x55ff4f6c2c80
        co = 0x55ff4f6c2c80
#7  0x00007f8f0d47f560 in __start_context () at /lib64/libc.so.6
#8  0x00007ffc759cb060 in  ()
#9  0x0000000000000000 in  ()

I get this in the log:

qemu-system-x86_64: block/mirror.c:335: mirror_iteration: Assertion
`hbitmap_next == next_sector' failed.


The system was compiled like this:

Install prefix    /usr
BIOS directory    /usr/share/qemu
binary directory  /usr/bin
library directory /usr/lib64
module directory  /usr/lib64/qemu
libexec directory /usr/libexec
include directory /usr/include
config directory  /etc
local state directory   /var
Manual directory  /usr/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path       /tmp/qemu-2.6.0-rc1
C compiler        cc
Host C compiler   cc
C++ compiler      c++
Objective-C compiler clang
ARFLAGS           rv
CFLAGS            -pthread -I/usr/include/glib-2.0 
-I/usr/lib64/glib-2.0/include -g -O2 -fPIC
QEMU_CFLAGS       -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt 
-DHAS_LIBSSH2_SFTP_FSYNC -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 
-D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef 
-Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common  
-Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs 
-Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers 
-Wold-style-declaration -Wold-style-definition -Wtype-limits 
-fstack-protector-strong -I/usr/include/p11-kit-1    -I/usr/include/libpng16 
-I/usr/include/spice-server -I/usr/include/cacard -I/usr/include/nss 
-I/usr/include/nspr -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include 
-I/usr/include/pixman-1 -I/usr/include/spice-1 -I/usr/include/cacard 
-I/usr/include/nss -I/usr/include/nspr -I/usr/include/glib-2.0 
-I/usr/lib64/glib-2.0/include -I/usr/include/libusb-1.0
LDFLAGS           -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g 
-L/usr/lib64
make              make
install           install
python            python -B
smbd              /usr/sbin/smbd
module support    no
host CPU          x86_64
host big endian   no
target list       x86_64-softmmu i386-softmmu
tcg debug enabled yes
gprof enabled     no
sparse enabled    no
strip binaries    no
profiler          no
static build      no
pixman            system
SDL support       yes
GTK support       yes
GTK GL support    no
GNUTLS support    yes
GNUTLS hash       yes
GNUTLS rnd        yes
libgcrypt         no
libgcrypt kdf     no
nettle            yes (3.2)
nettle kdf        yes
libtasn1          yes
VTE support       yes
curses support    yes
virgl support     no
curl support      yes
mingw32 support   no
Audio drivers     oss
Block whitelist (rw) 
Block whitelist (ro) 
VirtFS support    yes
VNC support       yes
VNC SASL support  yes
VNC JPEG support  yes
VNC PNG support   yes
xen support       no
brlapi support    no
bluez  support    no
Documentation     yes
PIE               yes
vde support       no
netmap support    no
Linux AIO support yes
ATTR/XATTR support yes
Install blobs     yes
KVM support       yes
RDMA support      no
TCG interpreter   no
fdt support       yes
preadv support    yes
fdatasync         yes
madvise           yes
posix_madvise     yes
sigev_thread_id   yes
uuid support      yes
libcap-ng support yes
vhost-net support yes
vhost-scsi support yes
Trace backends    log
spice support     yes (0.12.10/0.12.6)
rbd support       no
xfsctl support    yes
smartcard support yes
libusb            yes
usb net redir     no
OpenGL support    yes
OpenGL dmabufs    yes
libiscsi support  yes
libnfs support    no
build guest agent yes
QGA VSS support   no
QGA w32 disk info no
QGA MSI support   no
seccomp support   no
coroutine backend ucontext
coroutine pool    yes
GlusterFS support yes
Archipelago support no
gcov              gcov
gcov enabled      no
TPM support       yes
libssh2 support   yes
TPM passthrough   yes
QOM debugging     yes
vhdx              yes
lzo support       yes
snappy support    no
bzip2 support     yes
NUMA host support no
tcmalloc support  no
jemalloc support  no
avx2 optimization yes

I'm going to try and put the VM on an EXT4 partition and see if I can
duplicate the issue.  It might be related to ZFS.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1570134

Title:
  While committing snapshot qemu crashes with SIGABRT

Status in QEMU:
  New

Bug description:
  Information:

  OS: Slackware64-Current
  Compiled with: gcc version 5.3.0 (GCC)  / glibc 2.23
  Compiled using: 

  CFLAGS="-O2 -fPIC" \
  CXXFLAGS="-O2 -fPIC" \
  LDFLAGS="-L/usr/lib64" \
  ./configure \
    --prefix=/usr \
    --sysconfdir=/etc \
    --localstatedir=/var \
    --libdir=/usr/lib64 \
    --enable-spice \
    --enable-kvm \
    --enable-glusterfs \
    --enable-libiscsi \
    --enable-libusb \
    --target-list=x86_64-softmmu,i386-softmmu \
    --enable-debug

  Source: qemu-2.5.1.tar.bz2

  Running as:

  /usr/bin/qemu-system-x86_64 -name test1,debug-threads=on -S -machine
  pc-1.1,accel=kvm,usb=off -m 4096 -realtime mlock=off -smp
  2,sockets=2,cores=1,threads=1 -uuid
  4b30ec13-6609-4a56-8731-d400c38189ef -no-user-config -nodefaults
  -chardev
  
socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-4-test1/monitor.sock,server,nowait
  -mon chardev=charmonitor,id=monitor,mode=control -rtc
  base=localtime,clock=vm,driftfix=slew -global kvm-
  pit.lost_tick_policy=discard -no-shutdown -boot strict=on -device
  piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive
  file=/datastore/vm/test1/test1.img,format=qcow2,if=none,id=drive-
  virtio-disk0 -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive
  =drive-virtio-disk0,id=virtio-disk0,bootindex=2 -drive if=none,id
  =drive-ide0-1-0,readonly=on -device ide-cd,bus=ide.1,unit=0,drive
  =drive-ide0-1-0,id=ide0-1-0,bootindex=1 -netdev
  tap,fd=23,id=hostnet0,vhost=on,vhostfd=25 -device virtio-net
  pci,netdev=hostnet0,id=net0,mac=52:54:00:66:2e:0f,bus=pci.0,addr=0x3
  -vnc 0.0.0.0:0 -device cirrus-vga,id=video0,bus=pci.0,addr=0x2 -device
  virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 -msg timestamp=on

  File system:  zfs v0.6.5.6

  While running: 
  virsh blockcommit test1 vda --active --pivot --verbose

  VM running very heavy IO load

  GDB reporting:

  #0  0x00007fd80132c3f8 in raise () at /lib64/libc.so.6
  #1  0x00007fd80132dffa in abort () at /lib64/libc.so.6
  #2  0x00007fd801324c17 in __assert_fail_base () at /lib64/libc.so.6
  #3  0x00007fd801324cc2 in  () at /lib64/libc.so.6
  #4  0x000055d9918d7572 in bdrv_replace_in_backing_chain (old=0x55d993ed9c10, 
new=0x55d9931ccc10) at block.c:2096
          __PRETTY_FUNCTION__ = "bdrv_replace_in_backing_chain"
  #5  0x000055d991911869 in mirror_exit (job=0x55d993fef830, 
opaque=0x55d999bbefe0) at block/mirror.c:376
          to_replace = 0x55d993ed9c10
          s = 0x55d993fef830
          data = 0x55d999bbefe0
          replace_aio_context = <optimized out>
          src = 0x55d993ed9c10
  #6  0x000055d9918da1dc in block_job_defer_to_main_loop_bh 
(opaque=0x55d9940ce850) at blockjob.c:481
          data = 0x55d9940ce850
          aio_context = 0x55d9931a2610
  #7  0x000055d9918d014b in aio_bh_poll (address@hidden) at async.c:92
          bh = <optimized out>
          bhp = <optimized out>
          next = 0x55d99440f910
          ret = 1
  #8  0x000055d9918dc8c0 in aio_dispatch (ctx=0x55d9931a2610) at aio-posix.c:305
          node = <optimized out>
          progress = false
  #9  0x000055d9918d000e in aio_ctx_dispatch (source=<optimized out>, 
callback=<optimized out>, user_data=<optimized out>) at async.c:231
          ctx = <optimized out>
  #10 0x00007fd8037cf787 in g_main_context_dispatch () at 
/usr/lib64/libglib-2.0.so.0
  #11 0x000055d9918db03b in main_loop_wait () at main-loop.c:211
          context = 0x55d9931a3200
          pfds = <optimized out>
          ret = 0
          spin_counter = 1
          ret = 0
          timeout = 4294967295
          timeout_ns = <optimized out>
  #12 0x000055d9918db03b in main_loop_wait (timeout=<optimized out>) at 
main-loop.c:256
          ret = 0
          spin_counter = 1
          ret = 0
          timeout = 4294967295
          timeout_ns = <optimized out>
  #13 0x000055d9918db03b in main_loop_wait (nonblocking=<optimized out>) at 
main-loop.c:504
          ret = 0
          timeout = 4294967295
          timeout_ns = <optimized out>
  #14 0x000055d991679cc4 in main () at vl.c:1923
          nonblocking = <optimized out>
          last_io = 2
          i = <optimized out>
          snapshot = <optimized out>
          linux_boot = <optimized out>
          initrd_filename = <optimized out>
          kernel_filename = <optimized out>
          kernel_cmdline = <optimized out>
          boot_order = <optimized out>
          boot_once = <optimized out>
          ds = <optimized out>
          cyls = <optimized out>
          heads = <optimized out>
          secs = <optimized out>
          translation = <optimized out>
          hda_opts = <optimized out>
          opts = <optimized out>
          machine_opts = <optimized out>
          icount_opts = <optimized out>
          olist = <optimized out>
          optind = 49
          optarg = 0x7fffc6d27f43 "timestamp=on"
          loadvm = <optimized out>
          machine_class = 0x55d993194d10
          cpu_model = <optimized out>
          vga_model = 0x0
          qtest_chrdev = <optimized out>
          qtest_log = <optimized out>
          pid_file = <optimized out>
          incoming = <optimized out>
          defconfig = <optimized out>
          userconfig = false
          log_mask = <optimized out>
          log_file = <optimized out>
          trace_events = <optimized out>
          trace_file = <optimized out>
          maxram_size = <optimized out>
          ram_slots = <optimized out>
          vmstate_dump_file = <optimized out>
          main_loop_err = 0x0
          err = 0x0
          __func__ = "main"
  #15 0x000055d991679cc4 in main (argc=<optimized out>, argv=<optimized out>, 
envp=<optimized out>) at vl.c:4699
          i = <optimized out>
          snapshot = <optimized out>
          linux_boot = <optimized out>
          initrd_filename = <optimized out>
          kernel_filename = <optimized out>
          kernel_cmdline = <optimized out>
          boot_order = <optimized out>
          boot_once = <optimized out>
          ds = <optimized out>
          cyls = <optimized out>
          heads = <optimized out>
          secs = <optimized out>
          translation = <optimized out>
          hda_opts = <optimized out>
          opts = <optimized out>
          machine_opts = <optimized out>
          icount_opts = <optimized out>
          olist = <optimized out>
          optind = 49
          optarg = 0x7fffc6d27f43 "timestamp=on"
          loadvm = <optimized out>
          machine_class = 0x55d993194d10
          cpu_model = <optimized out>
          vga_model = 0x0
          qtest_chrdev = <optimized out>
          qtest_log = <optimized out>
          pid_file = <optimized out>
          incoming = <optimized out>
          defconfig = <optimized out>
          userconfig = false
          log_mask = <optimized out>
          log_file = <optimized out>
          trace_events = <optimized out>
          trace_file = <optimized out>
          maxram_size = <optimized out>
          ram_slots = <optimized out>
          vmstate_dump_file = <optimized out>
          main_loop_err = 0x0
          err = 0x0
          __func__ = "main"


  I can reproduce this at will, and can provide more information per a
  dev's request.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1570134/+subscriptions