[Qemu-devel] Crash on eject with -monitor stdio

[olig9]

Hello,
having just experimented with the -monitor option to get the monitor to
stdio, I got a mysterious segmentation fault.
This is tested with a freshly checked out version (but it also crashes with
older versions).
Command line: qemu -hda win98/win98-new.img -cdrom /dev/cdrom0 -boot c
-snapshot -monitor stdio
The disk image contains Win98SE; it also crashes with Win2000, but not with
FreeDOS (maybe because I can't access cdrom at all under FreeDOS).
After starting qemu, I paste or type the following two lines in the
terminal:
eject cdrom
change cdrom /dev/hdd
This should change the cdrom drive to my secondary drive.
If I now enter these two lines a second time, qemu crashes.

GDB shows this:

address@hidden:~/qemu$ gdb inst/cvs/qemu-1/i386-softmmu/qemu
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library
"/lib/tls/libthread_db.so.1".

(gdb) run -hda win98/win98-new.img -cdrom /dev/cdrom0 -boot c -snapshot
-monitor stdio
Starting program: /mnt/hdb5/qemu/inst/cvs/qemu-1/i386-softmmu/qemu -hda
win98/win98-new.img -cdrom /dev/cdrom0 -boot c -snapshot -monitor stdio
[Thread debugging using libthread_db enabled]
[New Thread 1078970080 (LWP 14726)]
Connected to host network interface: tun0
QEMU 0.6.2 monitor - type 'help' for more information
(qemu) eject cdrom
(qemu) change cdrom /dev/hdd
(qemu) eject cdrom

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1078970080 (LWP 14726)]
0x4108bb43 in mallopt () from /lib/tls/libc.so.6
(gdb) bt
#0  0x4108bb43 in mallopt () from /lib/tls/libc.so.6
#1  0x4108aa4b in free () from /lib/tls/libc.so.6
#2  0x08050288 in bdrv_close (bs=0x41149c60)
    at /home/oliver/qemu/inst/cvs/qemu-1/block.c:209
#3  0x08051c2f in eject_device (bs=0x8f4a008, force=0)
    at /home/oliver/qemu/inst/cvs/qemu-1/monitor.c:270
#4  0x08053596 in monitor_handle_command (cmdline=0x80fd580 "eject cdrom")
    at /home/oliver/qemu/inst/cvs/qemu-1/monitor.c:1763
#5  0x08053c7f in monitor_handle_command1 (opaque=0x0,
    cmdline=0x6464682f <Address 0x6464682f out of bounds>)
    at /home/oliver/qemu/inst/cvs/qemu-1/monitor.c:1991
#6  0x080515e0 in readline_handle_byte (ch=150436040)
    at /home/oliver/qemu/inst/cvs/qemu-1/readline.c:339
#7  0x08053c5d in term_read (opaque=0x0,
    buf=0xbfffdf80 "eject cdrom\rchange cdrom /dev/hdd\rþØÞ>ÿ\002", size=34)
    at /home/oliver/qemu/inst/cvs/qemu-1/monitor.c:1984
#8  0x0804e2e0 in main_loop_wait (timeout=1684301871)
    at /home/oliver/qemu/inst/cvs/qemu-1/vl.c:2645
#9  0x0804e4c4 in main_loop () at
/home/oliver/qemu/inst/cvs/qemu-1/vl.c:2721
#10 0x0804f464 in main (argc=10, argv=0xbffff814)
    at /home/oliver/qemu/inst/cvs/qemu-1/vl.c:3712
(gdb) frame 6
#6  0x080515e0 in readline_handle_byte (ch=150436040)
    at /home/oliver/qemu/inst/cvs/qemu-1/readline.c:339
339                 term_readline_func(term_readline_opaque, term_cmd_buf);
(gdb) p term_cmd_buf
$1 = "eject cdrom\000 /dev/hdd", '\0' <repeats 4074 times>
(gdb)


Does somebody know where exactly the error is? There are several
inconsistencies in the backtrace, but I have now clue where it starts...

Thanks for any help,
Oliver Gerlich

-- 
+++ NEU: GMX DSL_Flatrate! Schon ab 14,99 EUR/Monat! +++

GMX Garantie: Surfen ohne Tempo-Limit! http://www.gmx.net/de/go/dsl