Re: [Qemu-devel] [PULL 01/12] vl: Clean up user-creatable objects when exiting

[Eduardo Habkost]

On Tue, Sep 26, 2017 at 12:14:23PM +0200, Christian Borntraeger wrote:
> This patch triggers the following crash on shutdown:
> 
> 
>                 Stack trace of thread 61598:
>                 #0  0x000003ff8990915e pthread_join (libpthread.so.0)
>                 #1  0x00000000014ddfda qemu_thread_join (qemu-system-s390x)
>                 #2  0x00000000011bbd68 iothread_stop (qemu-system-s390x)
>                 #3  0x00000000011bbe36 iothread_instance_finalize 
> (qemu-system-s390x)
>                 #4  0x000000000135b4a4 object_deinit (qemu-system-s390x)
>                 #5  0x000000000135b548 object_finalize (qemu-system-s390x)
>                 #6  0x000000000135cc02 object_unref (qemu-system-s390x)
>                 #7  0x000000000135e61a object_finalize_child_property 
> (qemu-system-s390x)
>                 #8  0x000000000135b16a object_property_del_all 
> (qemu-system-s390x)
>                 #9  0x000000000135b536 object_finalize (qemu-system-s390x)
>                 #10 0x000000000135cc02 object_unref (qemu-system-s390x)
>                 #11 0x000000000135e61a object_finalize_child_property 
> (qemu-system-s390x)
>                 #12 0x000000000135b2ea object_property_del_child 
> (qemu-system-s390x)
>                 #13 0x000000000135b44a object_unparent (qemu-system-s390x)
>                 #14 0x0000000001362754 user_creatable_cleanup 
> (qemu-system-s390x)
>                 #15 0x00000000011d012a main (qemu-system-s390x)
>                 #16 0x000003ff8972289a __libc_start_main (libc.so.6)
>                 #17 0x0000000001017646 _start (qemu-system-s390x)

It seems to be reproducible with:

$ echo quit | ./x86_64-softmmu/qemu-system-x86_64 -object iothread,id=iothread0 
-monitor stdio -display none
QEMU 2.10.50 monitor - type 'help' for more information
(qemu) quit
qemu: qemu_thread_join: No such process
Aborted (core dumped)

iothread_stop() is being called twice for the same thread:

Thread 1 "qemu-system-x86" hit Breakpoint 3, qemu_thread_join (address@hidden) 
at /home/ehabkost/rh/proj/virt/qemu/util/qemu-thread-posix.c:543
543     {
(gdb) bt
#0  0x00000001005dc980 in qemu_thread_join (address@hidden) at 
/home/ehabkost/rh/proj/virt/qemu/util/qemu-thread-posix.c:543
#1  0x000000010034a12c in iothread_stop (object=<optimized out>, 
opaque=<optimized out>) at /home/ehabkost/rh/proj/virt/qemu/iothread.c:96
#2  0x0000000100509117 in do_object_child_foreach (address@hidden, 
address@hidden <iothread_stop>, address@hidden, address@hidden) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:843
#3  0x000000010050a7a7 in object_child_foreach (address@hidden, address@hidden 
<iothread_stop>, address@hidden) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:858
#4  0x000000010034a3be in iothread_stop_all () at 
/home/ehabkost/rh/proj/virt/qemu/iothread.c:331
#5  0x000000010021da4d in main (argc=<optimized out>, argv=<optimized out>, 
envp=<optimized out>) at /home/ehabkost/rh/proj/virt/qemu/vl.c:4886
(gdb) c
Continuing.

Thread 1 "qemu-system-x86" hit Breakpoint 3, qemu_thread_join (address@hidden) 
at /home/ehabkost/rh/proj/virt/qemu/util/qemu-thread-posix.c:543
543     {
(gdb) bt
#0  0x00000001005dc980 in qemu_thread_join (address@hidden) at 
/home/ehabkost/rh/proj/virt/qemu/util/qemu-thread-posix.c:543
#1  0x000000010034a12c in iothread_stop (address@hidden, address@hidden) at 
/home/ehabkost/rh/proj/virt/qemu/iothread.c:96
#2  0x000000010034a175 in iothread_instance_finalize (obj=0x10118e170) at 
/home/ehabkost/rh/proj/virt/qemu/iothread.c:111
#3  0x000000010050a90a in object_deinit (type=0x1010dd860, obj=<optimized out>) 
at /home/ehabkost/rh/proj/virt/qemu/qom/object.c:453
#4  0x000000010050a90a in object_finalize (data=0x10118e170) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:467
#5  0x000000010050a90a in object_unref (obj=0x10118e170) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:902
#6  0x000000010050a99d in object_property_del_all (obj=0x10118e390) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:404
#7  0x000000010050a99d in object_finalize (data=0x10118e390) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:466
#8  0x000000010050a99d in object_unref (obj=0x10118e390) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:902
#9  0x0000000100509915 in object_property_del_child (obj=0x101180900, 
child=0x10118e390, errp=<optimized out>) at 
/home/ehabkost/rh/proj/virt/qemu/qom/object.c:427
#10 0x000000010021da87 in main (argc=<optimized out>, argv=<optimized out>, 
envp=<optimized out>) at /home/ehabkost/rh/proj/virt/qemu/vl.c:4897

> 
> 
> command line parameters are long (one of my test systems)
> 
> -name guest=zhyp137,debug-threads=on -S -object 
> secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-7-zhyp137/master-key.aes
>  -machine 
> s390-ccw-virtio-2.11,accel=kvm,usb=off,dump-guest-core=off,loadparm=PROMPT -m 
> 2048 -realtime mlock=off -smp 4,sockets=4,cores=1,threads=1 -object 
> iothread,id=iothread1 -object iothread,id=iothread2 -object 
> iothread,id=iothread3 -object iothread,id=iothread4 -object 
> iothread,id=iothread5 -object iothread,id=iothread6 -object 
> iothread,id=iothread7 -object iothread,id=iothread8 -object 
> iothread,id=iothread9 -object iothread,id=iothread10 -object 
> iothread,id=iothread11 -object iothread,id=iothread12 -object 
> iothread,id=iothread13 -object iothread,id=iothread14 -object 
> iothread,id=iothread15 -object iothread,id=iothread16 -object 
> iothread,id=iothread17 -object iothread,id=iothread18 -object 
> iothread,id=iothread19 -object iothread,id=iothread20 -uuid 
> 4c3ae636-529d-4d90-b203-c8d3d150f0d0 -display none -no-user-config 
> -nodefaults -chardev 
> socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-7-zhyp137/monitor.sock,server,nowait
>  -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown 
> -boot strict=on -drive 
> file=/var/lib/libvirt/qemu/image.zhyp137,format=qcow2,if=none,id=drive-virtio-disk0,serial=skel,cache=none
>  -device 
> virtio-blk-ccw,iothread=iothread1,scsi=off,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
>  -drive 
> file=/var/lib/libvirt/qemu/image.zhyp137.old,format=qcow2,if=none,id=drive-virtio-disk1,serial=old,cache=none
>  -device 
> virtio-blk-ccw,iothread=iothread1,scsi=off,devno=fe.0.0001,drive=drive-virtio-disk1,id=virtio-disk1
>  -netdev tap,fd=24,id=hostnet0,vhost=on,vhostfd=26 -device 
> virtio-net-ccw,netdev=hostnet0,id=net0,mac=52:54:00:d1:cd:1c,devno=fe.0.000d 
> -chardev pty,id=charconsole0 -device 
> sclpconsole,chardev=charconsole0,id=console0 -device 
> virtio-balloon-ccw,id=balloon0,devno=fe.3.ffba -drive 
> driver=null-aio,id=null1,if=none,size=1500G -device 
> virtio-blk-ccw,scsi=off,drive=null1,serial=null1,iothread=iothread16 -drive 
> driver=null-aio,id=null2,if=none,size=1500G -device 
> virtio-blk-ccw,scsi=off,drive=null2,serial=null2,iothread=iothread17 -drive 
> driver=null-aio,id=null3,if=none,size=1500G -device 
> virtio-blk-ccw,scsi=off,drive=null3,serial=null3,iothread=iothread18 -drive 
> driver=null-aio,id=null4,if=none,size=1500G -device 
> virtio-blk-ccw,scsi=off,drive=null4,serial=null4,iothread=iothread19 -drive 
> driver=null-aio,id=null5,if=none,size=1500G -device 
> virtio-blk-ccw,scsi=off,drive=null5,serial=null5,iothread=iothread20,num-queues=10
>  -gdb tcp::1409 -msg timestamp=on
> 
> On 09/19/2017 10:18 PM, Eduardo Habkost wrote:
> > Delete all user-creatable objects in /objects when exiting QEMU, so they
> > can perform cleanup actions.
> > 
> > Signed-off-by: Eduardo Habkost <address@hidden>
> > Message-Id: <address@hidden>
> > Acked-by: Philippe Mathieu-Daudé <address@hidden>
> > Tested-by: Zack Cornelius <address@hidden>
> > Signed-off-by: Eduardo Habkost <address@hidden>
> > ---
> >  include/qom/object_interfaces.h | 8 ++++++++
> >  qom/object_interfaces.c         | 5 +++++
> >  vl.c                            | 1 +
> >  3 files changed, 14 insertions(+)
> > 
> > diff --git a/include/qom/object_interfaces.h 
> > b/include/qom/object_interfaces.h
> > index d63c1c28f8..d23e11bc53 100644
> > --- a/include/qom/object_interfaces.h
> > +++ b/include/qom/object_interfaces.h
> > @@ -147,4 +147,12 @@ int user_creatable_add_opts_foreach(void *opaque,
> >   */
> >  void user_creatable_del(const char *id, Error **errp);
> >  
> > +/**
> > + * user_creatable_cleanup:
> > + *
> > + * Delete all user-creatable objects and the user-creatable
> > + * objects container.
> > + */
> > +void user_creatable_cleanup(void);
> > +
> >  #endif
> > diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
> > index 3bb8959f09..6824a88caa 100644
> > --- a/qom/object_interfaces.c
> > +++ b/qom/object_interfaces.c
> > @@ -193,6 +193,11 @@ void user_creatable_del(const char *id, Error **errp)
> >      object_unparent(obj);
> >  }
> >  
> > +void user_creatable_cleanup(void)
> > +{
> > +    object_unparent(object_get_objects_root());
> > +}
> > +
> >  static void register_types(void)
> >  {
> >      static const TypeInfo uc_interface_info = {
> > diff --git a/vl.c b/vl.c
> > index 9e62e92aea..ad49314608 100644
> > --- a/vl.c
> > +++ b/vl.c
> > @@ -4887,6 +4887,7 @@ int main(int argc, char **argv, char **envp)
> >      audio_cleanup();
> >      monitor_cleanup();
> >      qemu_chr_cleanup();
> > +    user_creatable_cleanup();
> >      /* TODO: unref root container, check all devices are ok */
> >  
> >      return 0;
> > 

-- 
Eduardo