[Spice-devel] Postcopy+spice crash

[Gerd Hoffmann]

On Fr, 2016-12-02 at 17:44 +0000, Dr. David Alan Gilbert wrote:
> Hi Gerd,
>   I've got a moderately repeatable crash with spice playing
> a video + postcopy.  Some of the time I just get a warning
> (that I also get in precopy) but sometimes it turns into
> a backtrace;
> 
> This is:
>   f24 guest playing youtube fullscreen.
>   migration between 2.7.0<->current head (had crash both ways)
> 
> The warning I get with precopy most of the time is:
>   ./x86_64-softmmu/qemu-system-x86_64:26921): Spice-Warning **: red_memslots.c:94:validate_virt: virtual address out of range

That is in spice-server.  Which version do you run?
Adding spice-devel to Cc:

>     virt=0x7f5397ed002a+0x2925ff31 slot_id=1 group_id=1
>     slot=0x7f5397c00000-0x7f539bbfe000 delta=0x7f5397c00000

Base address looks sane.
Size (0x2925ff31) is bogous.

On a quick glance I'd blame the guest for sending corrupted commands.
Strange though that it happens on migration only, so there could be
a host issue too.  Or a timing issue triggered by migration.

Which migration phase?

Do you have seamless spice migration enabled?
If so: Does it still reproduce with seamless migration turned off?

> The crash I've had with postcopy is:
> red_dispatcher_loadvm_commands:
> id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0, delta 0
> id 1, group 1, virt start 7fbe83c00000, virt end 7fbe87bfe000, generation 0, delta 7fbe83c00000
> id 2, group 1, virt start 7fbe7fa00000, virt end 7fbe83a00000, generation 0, delta 7fbe7fa00000
> (./x86_64-softmmu/qemu-system-x86_64:22376): Spice-CRITICAL **: red_memslots.c:123:get_virt: slot_id 128 too big, addr=8000000000000000
> 
> #0  0x00007fc0aa42f49d in read () from /lib64/libpthread.so.0
> #1  0x00007fc0a8c36c01 in spice_backtrace_gstack () from /lib64/libspice-server.so.1
> #2  0x00007fc0a8c3e4f7 in spice_logv () from /lib64/libspice-server.so.1
> #3  0x00007fc0a8c3e655 in spice_log () from /lib64/libspice-server.so.1
> #4  0x00007fc0a8bfc6de in get_virt () from /lib64/libspice-server.so.1
> #5  0x00007fc0a8bfcb73 in red_get_data_chunks_ptr () from /lib64/libspice-server.so.1
> #6  0x00007fc0a8bff3fa in red_get_cursor_cmd () from /lib64/libspice-server.so.1
> #7  0x00007fc0a8c0fd79 in handle_dev_loadvm_commands () from /lib64/libspice-server.so.1
> #8  0x00007fc0a8bf9523 in dispatcher_handle_recv_read () from /lib64/libspice-server.so.1
> #9  0x00007fc0a8c1d5a5 in red_worker_main () from /lib64/libspice-server.so.1
> #10 0x00007fc0aa428dc5 in start_thread () from /lib64/libpthread.so.0
> #11 0x00007fc0a61786ed in clone () from /lib64/libc.so.6

Spice worker thread ...

> red_dispatcher_loadvm_commands:
> id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0, delta 0
> id 1, group 1, virt start 7f3b93800000, virt end 7f3b977fe000, generation 0, delta 7f3b93800000
> id 2, group 1, virt start 7f3b8f400000, virt end 7f3b93400000, generation 0, delta 7f3b8f400000
> (/opt/qemu/v2.7.0/bin/qemu-system-x86_64:41053): Spice-CRITICAL **: red_memslots.c:123:get_virt: slot_id 80 too big, addr=5000000000000000


... trying to decode a invalid qxl address.

> I'm using:
> spice-server-devel-0.12.4-19.el7.x86_64

Ah, RHEL-7.3 host.

cheers,
  Gerd