Re: [Qemu-devel] [PATCH v2 2/2] qom/object.c: Allow itf cast with num_itfs = 0

[Anthony Liguori]

Peter Crosthwaite <address@hidden> writes:

> num_interfaces only tells you how many interfaces the concrete child class has
> (as defined in the TypeInfo). This means if you have a child class which 
> defines
> no interfaces of its own, but its parent has interfaces you cannot cast to 
> those
> parent interfaces.
>
> Fixed changing the guard to check the class->interfaces list instead (which is
> a complete flattened list of implemented interfaces).
>
> Signed-off-by: Peter Crosthwaite <address@hidden>

I must admit I don't understand it yet, but this breaks hot unplug.

Here is the qemu-test output:

address@hidden qemu-test]$ QEMU_TEST_SEED=45240 ./qemu-test 
~/build/qemu/x86_64-softmmu/qemu-system-x86_64 tests/device-del.sh
Using RANDOM seed 45240
Testing nic
Formatting '.tmp-31849/disk.img', fmt=qcow2 size=10737418240 encryption=off 
cluster_size=65536 lazy_refcounts=off 
/home/aliguori/build/qemu/x86_64-softmmu/qemu-system-x86_64 -kernel 
/usr/local/share/qemu-jeos/kernel-x86_64-pc -initrd 
.tmp-31849/initramfs-31849.img.gz -device isa-debug-exit -append console=ttyS0 
seed=45240 -nographic -enable-kvm -device virtio-balloon-pci -pidfile 
.tmp-31849/pidfile-31849.pid -qmp 
unix:.tmp-31849/qmpsock-31849.sock,server,nowait
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.4.0 (address@hidden) (gcc version 4.6.4 20120830 
(prerelease) (GCC) ) #2 SMP Mon Dec 3 19:40:41 CST 2012
[    0.000000] Command line: console=ttyS0 seed=45240
[    0.000000] BIOS-provided physical RAM map:

<- snip ->

[    0.865631] Freeing unused kernel memory: 584k freed
[    0.866320] Write protecting the kernel read-only data: 12288k
[    0.868626] Freeing unused kernel memory: 640k freed
[    0.873366] Freeing unused kernel memory: 1724k freed
Setting guest RANDOM seed to 45240
*** Running tests ***
/tests/device-del.sh
Running test /tests/device-del.sh...
** waiting for hotplug **
./tests/device-del.sh: line 36: test: !=: unary operator expected
** waiting for remove **
** waiting for guest to see device **
./qemu-test: line 99: 31883 Segmentation fault      (core dumped) "$@"

The backtrace is:

Program terminated with signal 11, Segmentation fault.
#0  qemu_bh_delete (bh=0x0) at /home/aliguori/git/qemu/async.c:116
116         bh->scheduled = 0;
Missing separate debuginfos, use: debuginfo-install 
bzip2-libs-1.0.6-7.fc18.x86_64 glib2-2.34.2-2.fc18.x86_64 
glibc-2.16-28.fc18.x86_64 libaio-0.3.109-6.fc18.x86_64 
libgcc-4.7.2-8.fc18.x86_64 pixman-0.26.2-5.fc18.x86_64 
xen-libs-4.2.1-5.fc18.x86_64 xz-libs-5.1.2-2alpha.fc18.x86_64 
zlib-1.2.7-9.fc18.x86_64
(gdb) bt
#0  qemu_bh_delete (bh=0x0) at /home/aliguori/git/qemu/async.c:116
#1  0x00007f55cac9bd95 in virtio_net_exit (vdev=0x7f55cd6eb960)
    at /home/aliguori/git/qemu/hw/virtio-net.c:1413
#2  0x00007f55cabde7f9 in virtio_net_exit_pci (pci_dev=0x7f55cd668260)
    at /home/aliguori/git/qemu/hw/virtio-pci.c:1016
#3  0x00007f55cab92e4a in pci_unregister_device (dev=<optimized out>)
    at /home/aliguori/git/qemu/hw/pci/pci.c:889
#4  0x00007f55caba7485 in device_unparent (obj=<optimized out>)
    at /home/aliguori/git/qemu/hw/qdev.c:773
#5  0x00007f55cac1ea0f in object_unparent (obj=0x7f55cd668260)
    at /home/aliguori/git/qemu/qom/object.c:370
#6  0x00007f55caba7a4d in qdev_free (dev=<optimized out>)
    at /home/aliguori/git/qemu/hw/qdev.c:270
#7  0x00007f55cab38da0 in acpi_piix_eject_slot (s=0x7f55cd68fd50, 
    slots=<optimized out>) at /home/aliguori/git/qemu/hw/acpi_piix4.c:306
#8  0x00007f55caca70f2 in access_with_adjusted_size (address@hidden, 
    address@hidden, size=4, access_size_min=<optimized out>, 
    access_size_max=<optimized out>, address@hidden
    0x7f55caca7710 <memory_region_write_accessor>, address@hidden
    0x7f55cd690540) at /home/aliguori/git/qemu/memory.c:364
#9  0x00007f55caca8767 in memory_region_iorange_write (
    iorange=<optimized out>, offset=8, width=4, data=32)
    at /home/aliguori/git/qemu/memory.c:439

It very much looks like a double free to me of the device.

The test is doing a simple device_del in the monitor.

Regards,

Anthony Liguori

> ---
> changed from v1:
> Change guard implementation rather than removed it (Paolo review)
>
>  qom/object.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index 4b72a64..3d638ff 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -449,7 +449,8 @@ ObjectClass *object_class_dynamic_cast(ObjectClass *class,
>      TypeImpl *type = class->type;
>      ObjectClass *ret = NULL;
>  
> -    if (type->num_interfaces && type_is_ancestor(target_type, 
> type_interface)) {
> +    if (type->class->interfaces &&
> +            type_is_ancestor(target_type, type_interface)) {
>          int found = 0;
>          GSList *i;
>  
> -- 
> 1.7.0.4