diff options
Diffstat (limited to 'results/classifier/zero-shot/108/other/1594861')
| -rw-r--r-- | results/classifier/zero-shot/108/other/1594861 | 359 |
1 files changed, 359 insertions, 0 deletions
diff --git a/results/classifier/zero-shot/108/other/1594861 b/results/classifier/zero-shot/108/other/1594861 new file mode 100644 index 000000000..863ff1ff2 --- /dev/null +++ b/results/classifier/zero-shot/108/other/1594861 @@ -0,0 +1,359 @@ +device: 0.891 +debug: 0.866 +permissions: 0.839 +other: 0.823 +performance: 0.808 +graphic: 0.806 +network: 0.790 +vnc: 0.787 +socket: 0.775 +PID: 0.769 +boot: 0.761 +semantic: 0.748 +KVM: 0.734 +files: 0.720 + +QEMU crashes when slow VNC client disconnects + +QEMU (at least 2.6.0 and today's git origin/master 6f1d2d1c5ad20d464705b17318cb7ca495f8078a) crashes when a slow VNC client disconnects during a time of busy VNC updates, with: +qemu_mutex_lock: Invalid argument + +This is easily repeatable: + - Start up a QEMU with the Finnix 1.10 CD-ROM, as below + - vnclient host:0 -shared (remote X11-based vnc client, to make it "slow") + - On the Finnix command line, run: "while :; do ls -laRC /; done" to generate screen updates + - Close the vncclient + - QEMU crashes on locking an already free'd mutex (note that the VNC state's share_mode is DISCONNECTED) + + + +# gdb qemu-system-x86_64 +GNU gdb (GDB) 7.11.1 +Copyright (C) 2016 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. Type "show copying" +and "show warranty" for details. +This GDB was configured as "x86_64-pc-linux-gnu". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<http://www.gnu.org/software/gdb/bugs/>. +Find the GDB manual and other documentation resources online at: +<http://www.gnu.org/software/gdb/documentation/>. +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from qemu-system-x86_64...done. +(gdb) run -cdrom finnix-110.iso -m 1G -vga cirrus -usbdevice tablet -net nic,model=e1000 -net user -rtc base=localtime,clock=host -enable-kvm -vnc :0,share=ignore -monitor stdio +Starting program: qemu-system-x86_64 -cdrom finnix-110.iso -m 1G -vga cirrus -usbdevice tablet -net nic,model=e1000 -net user -rtc base=localtime,clock=host -enable-kvm -vnc :0,share=ignore -monitor stdio +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/usr/lib/libthread_db.so.1". +[New Thread 0x7ffff1ca2700 (LWP 25717)] +Failed to initialize module: /usr/lib/qemu/block-dmg.so +Note: only modules from the same build can be loaded. +[New Thread 0x7ffff129d700 (LWP 25718)] +QEMU 2.6.50 monitor - type 'help' for more information +(qemu) [New Thread 0x7ffff08ba700 (LWP 25719)] +[New Thread 0x7fffaabff700 (LWP 25721)] +[Thread 0x7ffff129d700 (LWP 25718) exited] +[New Thread 0x7ffff129d700 (LWP 25724)] +[Thread 0x7ffff129d700 (LWP 25724) exited] +[New Thread 0x7ffff129d700 (LWP 25728)] +qemu: qemu_mutex_lock: Invalid argument + +Thread 1 "qemu-system-x86" received signal SIGABRT, Aborted. +0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6 +(gdb) thread apply all backtrace + +Thread 7 (Thread 0x7ffff129d700 (LWP 25728)): +#0 0x00007ffff634b5f5 in do_futex_wait () from /usr/lib/libpthread.so.0 +#1 0x00007ffff634b6bf in __new_sem_wait_slow () from /usr/lib/libpthread.so.0 +#2 0x00007ffff634b772 in sem_timedwait () from /usr/lib/libpthread.so.0 +#3 0x0000555555a7fcb7 in qemu_sem_timedwait (sem=sem@entry=0x555556518c38, ms=ms@entry=10000) + at util/qemu-thread-posix.c:245 +#4 0x00005555559f281c in worker_thread (opaque=0x555556518bd0) at thread-pool.c:92 +#5 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0 +#6 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6 + +Thread 5 (Thread 0x7fffaabff700 (LWP 25721)): +#0 0x00007ffff634903f in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0 +#1 0x0000555555a7fb69 in qemu_cond_wait (cond=cond@entry=0x555556541790, mutex=mutex@entry=0x5555565417c0) + at util/qemu-thread-posix.c:123 +#2 0x00005555559ecb4b in vnc_worker_thread_loop (queue=queue@entry=0x555556541790) at ui/vnc-jobs.c:228 +#3 0x00005555559ed088 in vnc_worker_thread (arg=0x555556541790) at ui/vnc-jobs.c:335 +#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0 +#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6 + +Thread 4 (Thread 0x7ffff08ba700 (LWP 25719)): +#0 0x00007ffff4979277 in ioctl () from /usr/lib/libc.so.6 +#1 0x00005555557d3484 in kvm_vcpu_ioctl (cpu=cpu@entry=0x55555651f2d0, type=type@entry=44672) + at kvm-all.c:2057 +#2 0x00005555557d353d in kvm_cpu_exec (cpu=cpu@entry=0x55555651f2d0) + at kvm-all.c:1907 +#3 0x00005555557c1ea4 in qemu_kvm_cpu_thread_fn (arg=0x55555651f2d0) + at cpus.c:1078 +#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0 +#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6 + +Thread 2 (Thread 0x7ffff1ca2700 (LWP 25717)): +#0 0x00007ffff497c7f9 in syscall () from /usr/lib/libc.so.6 +#1 0x0000555555a7fe75 in futex_wait (val=<optimized out>, ev=<optimized out>) at util/qemu-thread-posix.c:292 +#2 qemu_event_wait (ev=ev@entry=0x55555646bb64 <rcu_call_ready_event>) at util/qemu-thread-posix.c:399 +#3 0x0000555555a8e26e in call_rcu_thread (opaque=<optimized out>) at util/rcu.c:250 +#4 0x00007ffff6343424 in start_thread () from /usr/lib/libpthread.so.0 +#5 0x00007ffff4980cbd in clone () from /usr/lib/libc.so.6 + +Thread 1 (Thread 0x7ffff7f94a80 (LWP 25713)): +#0 0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6 +#1 0x00007ffff48cd72a in abort () from /usr/lib/libc.so.6 +#2 0x000055555579290b in error_exit (err=<optimized out>, + msg=msg@entry=0x555555b59d30 <__func__.14707> "qemu_mutex_lock") at util/qemu-thread-posix.c:39 +#3 0x0000555555a7faa0 in qemu_mutex_lock (mutex=mutex@entry=0x555556566568) at util/qemu-thread-posix.c:66 +#4 0x00005555559da91f in vnc_lock_output (vs=0x55555655a320) at ui/vnc-jobs.h:62 +#5 vnc_client_write (vs=0x55555655a320) at ui/vnc.c:1361 +#6 vnc_client_io (ioc=<optimized out>, condition=<optimized out>, opaque=0x55555655a320) at ui/vnc.c:1483 +#7 0x00007ffff53a6dba in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 +#8 0x00005555559fa6eb in glib_pollfds_poll () at main-loop.c:213 +#9 os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:258 +#10 main_loop_wait (nonblocking=<optimized out>) at main-loop.c:506 +#11 0x00005555557974a4 in main_loop () at vl.c:1925 +#12 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4628 +(gdb) thread 1 +[Switching to thread 1 (Thread 0x7ffff7f94a80 (LWP 25713))] +#0 0x00007ffff48cc2a8 in raise () from /usr/lib/libc.so.6 +(gdb) frame 5 +#5 vnc_client_write (vs=0x55555655a320) at ui/vnc.c:1361 +1361 vnc_lock_output(vs); +(gdb) set max-value-size 80000 +(gdb) print *vs +$1 = {sioc = 0x555557b1da40, ioc = 0x555557998790, ioc_tag = 0, disconnecting = 0, dirty = {{0, 0, 0}, {0, 0, 0}, { + 1055221925019647, 0, 0}, {1055221925019647, 0, 0}, {773781307523071, 0, 0}, {1125899906842623, 0, 0}, { + 1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {1125899906842623, 0, 0}, { + 1125899906842623, 0, 0}, {1125899906842623, 0, 0}, {71193947300417, 0, 0}, {71193947300433, 0, 0}, { + 71193947300417, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1319379593592831, 0, 0}, {1319379593592831, 0, 0}, { + 1319379593592831, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, { + 2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, {2251799813685247, 0, 0}, { + 106275268473665, 0, 0}, {115071496237889, 0, 0}, {106275268473665, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, { + 381680068419649535, 0, 0}, {381680068419649535, 0, 0}, {309622474381721599, 0, 0}, {576460752303423487, 0, 0}, { + 576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {576460752303423487, 0, 0}, { + 576460752303423487, 0, 0}, {576460752303423487, 0, 0}, {106194469454161, 0, 0}, {36285762154894705, 0, 0}, { + 106194469454161, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {307370399690129407, 0, 0}, {307370399690129407, 0, 0}, + {307370399690129407, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, { + 569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, { + 55615324492583, 0, 0}, {36225287405246247, 0, 0}, {55615324492583, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, { + 451468244688044031, 0, 0}, {451468244688044031, 0, 0}, {451468244688044031, 0, 0}, {569705352862367743, 0, 0}, { + 569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {569705352862367743, 0, 0}, { + 569705352862367743, 0, 0}, {569705352862367743, 0, 0}, {55546325181303, 0, 0}, {36154780942280567, 0, 0}, { + 55546325181303, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {3406691643129069567, 0, 0}, {3406691643129069567, 0, + 0}, {3406691643129069567, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, + 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, { + 4607182418800017407, 0, 0}, {432929977792532287, 0, 0}, {541438925046353727, 0, 0}, {432929977792532287, 0, 0}, { + 0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {2831620673523154943, 0, 0}, {2831620673523154943, 0, 0}, {2831620673523154943, + 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, { + 4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, 0}, {4607182418800017407, 0, + 0}, {721827755353776959, 0, 0}, {830336702607599423, 0, 0}, {721827755353776959, 0, 0}, {0, 0, 0}, {0, 0, 0}, { + 0, 0, 0}, {1543608686381891327, 0, 0}, {1543608686381891327, 0, 0}, {1543045736428470271, 0, 0}, { + 4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, + 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {721970826084188599, + 0, 0}, {253878283546232247, 0, 0}, {145510073780765111, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, { + 1517695344798859263, 0, 0}, {1517695344798859263, 0, 0}, {1515461137171218431, 0, 0}, {4580160821035794431, 0, + 0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431, + 0, 0}, {4580160821035794431, 0, 0}, {4580160821035794431, 0, 0}, {226043368113417, 0, 0}, {72565387932009739, 0, + 0}, {226043368113417, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1522216674051227647, 0, 0}, {1522216674051227647, + 0, 0}, {1517713074423857151, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, { + 2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0, 0}, {2278821411449470975, 0, + 0}, {2278821411449470975, 0, 0}, {638357209941807, 0, 0}, {73127235220875119, 0, 0}, {638357209941807, 0, 0}, { + 0, 0, 0}, {0, 0, 0}, {0, 0, 0}, {1873497444986126335, 0, 0}, {1873497444986126335, 0, 0}, {1873497376266649599, + 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, { + 4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, 0}, {4611686018427387903, 0, + 0}, {36244873060242763, 0, 0}, {115366073929258319, 0, 0}, {36244873060242763, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, + 0, 0}, {1125899872482361343, 0, 0}, {1125899872482361343, 0, 0}, {1125899735043407871, 0, 0}, { + 2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, + 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {2305843009213693951, 0, 0}, {325521969941073283, + 0, 0}, {397861314371603915, 0, 0}, {325521969941073283, 0, 0}, {0, 0, 0}, {0, 0, 0}, {0, 0, 0}, { + 1121396238495776767, 0, 0}, {1121396238495776767, 0, 0}, {1121396307215253503, 0, 0}, {1143914305352105983, 0, + 0}, {1143914305352105983, 0, 0}, {1143914305352105983, 0, 0}...}, lossy_rect = 0x555557b1da50, + vd = 0x5555585000a0, need_update = 1, force_update = 0, has_dirty = 192431, features = 723, absolute = 1, + last_x = 512, last_y = 384, last_bmask = 0, client_width = 1024, client_height = 768, + share_mode = VNC_SHARE_MODE_DISCONNECTED, vnc_encoding = 7, major = 3, minor = 8, auth = 1, subauth = 0, + challenge = '\000' <repeats 15 times>, tls = 0x0, encode_ws = false, websocket = false, info = 0x555557976a30, + output = {name = 0x0, capacity = 0, offset = 0, avg_size = 4194304, buffer = 0x0}, input = {name = 0x0, + capacity = 0, offset = 0, avg_size = 524288, buffer = 0x0}, write_pixels = 0x5555559daae0 <vnc_write_pixels_copy>, + client_pf = {bits_per_pixel = 32 ' ', bytes_per_pixel = 4 '\004', depth = 24 '\030', rmask = 16711680, + gmask = 65280, bmask = 255, amask = 0, rshift = 16 '\020', gshift = 8 '\b', bshift = 0 '\000', ashift = 24 '\030', + rmax = 255 '\377', gmax = 255 '\377', bmax = 255 '\377', amax = 0 '\000', rbits = 8 '\b', gbits = 8 '\b', + bbits = 8 '\b', abits = 0 '\000'}, client_format = 0, client_be = false, audio_cap = 0x0, as = {freq = 44100, + nchannels = 2, fmt = AUD_FMT_S16, endianness = 0}, read_handler = 0x5555559dbdc0 <protocol_client_msg>, + read_handler_expect = 1, modifiers_state = '\000' <repeats 255 times>, led = 0x5555572f5c40, abort = false, + initialized = true, output_mutex = {lock = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, + __kind = -1, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, + __size = '\000' <repeats 16 times>, "\377\377\377\377", '\000' <repeats 19 times>, __align = 0}}, + bh = 0x555557929d00, jobs_buffer = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, tight = { + type = 7, quality = 255 '\377', compression = 9 '\t', pixel24 = 1 '\001', tight = {name = 0x0, capacity = 0, + offset = 0, avg_size = 1890052, buffer = 0x0}, tmp = {name = 0x7fff9c0d3830 "vnc-worker-output", + capacity = 32768, offset = 26162, avg_size = 4194304, buffer = 0x555557786540 "\330R\303\364\377\177"}, zlib = { + name = 0x0, capacity = 0, offset = 0, avg_size = 524288, buffer = 0x0}, gradient = {name = 0x0, capacity = 0, + offset = 0, avg_size = 0, buffer = 0x0}, jpeg = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, + buffer = 0x0}, png = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, levels = {9, 9, 9, 0}, + stream = {{next_in = 0x7fff9c1341f0 "", avail_in = 0, total_in = 282144, + next_out = 0x7fff9c0640fd "\256\022\352]\002\210n\021rg\b\271\v\204\334\361\001", avail_out = 4083, + total_out = 40323, msg = 0x0, state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>, + zfree = 0x5555559deb50 <vnc_zlib_zfree>, opaque = 0x7fffaabec3f0, data_type = 0, adler = 1422910222, + reserved = 0}, {next_in = 0x7fff9c134210 "", avail_in = 0, total_in = 3212411, + next_out = 0x7fff9c0640f9 "\377\235&\344\256\022\352]\002\210n\021rg\b\271\v\204\334\361\001", + avail_out = 4087, total_out = 1563572, msg = 0x0, state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>, + zfree = 0x5555559deb50 <vnc_zlib_zfree>, opaque = 0x7fffaabec3f0, data_type = 0, adler = 2665424950, + reserved = 0}, {next_in = 0x7fff9c134440 "", avail_in = 0, total_in = 1057759, + next_out = 0x7fff9c064148 ">E\025\322fI \220\262\320\322\024", avail_out = 4008, total_out = 83411, msg = 0x0, + state = 0x0, zalloc = 0x5555559deb40 <vnc_zlib_zalloc>, zfree = 0x5555559deb50 <vnc_zlib_zfree>, + opaque = 0x7fffaabec3f0, data_type = 0, adler = 3032660148, reserved = 0}, {next_in = 0x0, avail_in = 0, + total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, zalloc = 0x0, zfree = 0x0, + opaque = 0x0, data_type = 0, adler = 0, reserved = 0}}}, zlib = {zlib = {name = 0x0, capacity = 0, offset = 0, + avg_size = 0, buffer = 0x0}, tmp = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, stream = { + next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, + zalloc = 0x0, zfree = 0x0, opaque = 0x0, data_type = 0, adler = 0, reserved = 0}, level = 0}, hextile = { + send_tile = 0x5555559df670 <send_hextile_tile_32>}, zrle = {type = 0, fb = {name = 0x0, capacity = 0, offset = 0, + avg_size = 0, buffer = 0x0}, zrle = {name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, tmp = { + name = 0x0, capacity = 0, offset = 0, avg_size = 0, buffer = 0x0}, zlib = {name = 0x0, capacity = 0, offset = 0, + avg_size = 0, buffer = 0x0}, stream = {next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0, + total_out = 0, msg = 0x0, state = 0x0, zalloc = 0x0, zfree = 0x0, opaque = 0x0, data_type = 0, adler = 0, + reserved = 0}, palette = {pool = {{idx = 0, color = 0, next = {le_next = 0x0, + le_prev = 0x0}} <repeats 256 times>}, size = 0, max = 0, bpp = 0, table = {{ + lh_first = 0x0} <repeats 256 times>}}}, zywrle = {buf = {0 <repeats 4096 times>}}, mouse_mode_notifier = { + notify = 0x5555559db450 <check_pointer_type_change>, node = {le_next = 0x0, + le_prev = 0x5555560586f8 <mouse_mode_notifiers>}}, next = {tqe_next = 0x0, tqe_prev = 0x5555585000a0}} + + + +QEMU build config: + +Install prefix /usr +BIOS directory /usr/share/qemu +binary directory /usr/bin +library directory /usr/lib +module directory /usr/lib/qemu +libexec directory /usr/lib/qemu +include directory /usr/include +config directory /etc +local state directory /var +Manual directory /usr/share/man +ELF interp prefix /usr/gnemul/qemu-%M +Source path /home/me/build/qemu/src/qemu-git +C compiler cc +Host C compiler cc +C++ compiler c++ +Objective-C compiler cc +ARFLAGS rv +CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -g -march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fPIC +QEMU_CFLAGS -I/usr/include/pixman-1 -Werror -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong -I/usr/include/libpng16 -I/usr/include/spice-server -I/usr/include/cacard -I/usr/include/nss -I/usr/include/nspr -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/pixman-1 -I/usr/include/spice-1 -I/usr/include/libusb-1.0 +LDFLAGS -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g -Wl,-O1,--sort-common,--as-needed,-z,relro +make make +install install +python /usr/bin/python2 -B +smbd /usr/sbin/smbd +module support yes +host CPU x86_64 +host big endian no +target list x86_64-softmmu i386-softmmu +tcg debug enabled no +gprof enabled no +sparse enabled no +strip binaries yes +profiler no +static build no +pixman system +SDL support yes (1.2.15) +GTK support no +GTK GL support no +VTE support no +GNUTLS support no +GNUTLS hash no +GNUTLS rnd no +libgcrypt no +libgcrypt kdf no +nettle no +nettle kdf no +libtasn1 yes +curses support yes +virgl support no +curl support no +mingw32 support no +Audio drivers sdl +Block whitelist (rw) +Block whitelist (ro) +VirtFS support no +VNC support yes +VNC SASL support no +VNC JPEG support yes +VNC PNG support yes +xen support no +brlapi support no +bluez support no +Documentation yes +PIE yes +vde support yes +netmap support no +Linux AIO support yes +ATTR/XATTR support yes +Install blobs yes +KVM support yes +RDMA support no +TCG interpreter no +fdt support no +preadv support yes +fdatasync yes +madvise yes +posix_madvise yes +uuid support yes +libcap-ng support yes +vhost-net support yes +vhost-scsi support yes +Trace backends nop +spice support yes (0.12.10/0.12.6) +rbd support no +xfsctl support yes +smartcard support no +libusb yes +usb net redir no +OpenGL support no +OpenGL dmabufs no +libiscsi support no +libnfs support no +build guest agent no +QGA VSS support no +QGA w32 disk info no +QGA MSI support no +seccomp support yes +coroutine backend ucontext +coroutine pool yes +GlusterFS support no +Archipelago support no +gcov gcov +gcov enabled no +TPM support yes +libssh2 support no +TPM passthrough yes +QOM debugging yes +vhdx no +lzo support no +snappy support no +bzip2 support no +NUMA host support yes +tcmalloc support no +jemalloc support no +avx2 optimization yes + +The only place we free the mutex is in vnc_disconnect_finish() which is only ever called from vnc_client_read(), in turn called from vnc_client_io(). + +We're crashing in vnc_client_write() which is called from vnc_client_io(). + +The stack trace has optimized out the "condition" param in vnc_client_io(), but what I'm guessing is that vnc_client_io() is invoked with both G_IO_OUT and G_IO_IN set. We process G_IO_IN, calling vnc_disconnect_finish, and then carry on to process G_IO_OUT. It looks like we need to skip the G_IO_OUT processing if we called vnc_disconnect_finish during G_IO_IN handling + +Potential fix posted + +https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg07693.html + +If you are able to test with this patch any feedback would be welcome. + +Fix has been included in QEMU v2.7.0: +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=ea697449884d83b83fefb + |