#888182 qemu-system-arm: qemu-system-arm crashes when run as part of the nbdkit testsuite

Package:
qemu-system-arm
Source:
qemu
Description:
QEMU full system emulation binaries (arm)
Submitter:
Hilko Bengen
Date:
2025-08-11 08:27:04 UTC
Severity:
normal
#888182#5
Date:
2018-01-23 20:07:13 UTC
From:
To:
Dear Maintainer,

I just got an nbdkit build failure from the armhf autobuilders. The
test-suite uses libguestfs and spawns qemu-system-arm which is killed by
SIGSEGV. Please see
https://buildd.debian.org/status/fetch.php?pkg=nbdkit&arch=armhf&ver=1.1.28-1&stamp=1516723989&raw=0
for the build log.

I re-ran the check in an armhf porterbox chroot (abel) and got the
output below. I don't see any useful output after starting
qemu-system-arm, but at least the command line parameters are visible.

,----
| $ LIBGUESTFS_TRACE=1 LIBGUESTFS_DEBUG=1 make check
| [...]
| guestfish -N fs -m /dev/sda1 write /hello.txt "hello,world"
| libguestfs: trace: set_verbose true
| libguestfs: trace: set_verbose = 0
| libguestfs: create: flags = 0, handle = 0x10e8ee8, program = guestfish
| libguestfs: trace: disk_create "test1.img" "raw" 104857600 "preallocation:sparse"
| libguestfs: trace: disk_create = 0
| libguestfs: trace: set_pgroup true
| libguestfs: trace: set_pgroup = 0
| libguestfs: trace: add_drive "test1.img" "format:raw"
| libguestfs: trace: add_drive = 0
| libguestfs: trace: is_config
| libguestfs: trace: is_config = 1
| libguestfs: trace: launch
| libguestfs: trace: get_tmpdir
| libguestfs: trace: get_tmpdir = "/tmp"
| libguestfs: trace: version
| libguestfs: trace: version = <struct guestfs_version = major: 1, minor: 36, release: 11, extra: , >
| libguestfs: trace: get_backend
| libguestfs: trace: get_backend = "direct"
| libguestfs: launch: program=guestfish
| libguestfs: launch: version=1.36.11
| libguestfs: launch: backend registered: unix
| libguestfs: launch: backend registered: uml
| libguestfs: launch: backend registered: libvirt
| libguestfs: launch: backend registered: direct
| libguestfs: launch: backend=direct
| libguestfs: launch: tmpdir=/tmp/libguestfsZiGbYj
| libguestfs: launch: umask=0022
| libguestfs: launch: euid=2596
| libguestfs: is_openable: /dev/kvm: No such file or directory
| libguestfs: trace: get_backend_setting "force_tcg"
| libguestfs: trace: get_backend_setting = NULL (error)
| libguestfs: trace: get_cachedir
| libguestfs: trace: get_cachedir = "/var/tmp"
| libguestfs: begin building supermin appliance
| libguestfs: run supermin
| libguestfs: command: run: /usr/bin/supermin
| libguestfs: command: run: \ --build
| libguestfs: command: run: \ --verbose
| libguestfs: command: run: \ --if-newer
| libguestfs: command: run: \ --lock /var/tmp/.guestfs-2596/lock
| libguestfs: command: run: \ --copy-kernel
| libguestfs: command: run: \ -f ext2
| libguestfs: command: run: \ --host-cpu arm
| libguestfs: command: run: \ /usr/lib/arm-linux-gnueabihf/guestfs/supermin.d
| libguestfs: command: run: \ -o /var/tmp/.guestfs-2596/appliance.d
| supermin: version: 5.1.19
| supermin: package handler: debian/dpkg
| supermin: acquiring lock on /var/tmp/.guestfs-2596/lock
| supermin: if-newer: output does not need rebuilding
| libguestfs: finished building supermin appliance
| libguestfs: begin testing qemu features
| libguestfs: trace: get_cachedir
| libguestfs: trace: get_cachedir = "/var/tmp"
| libguestfs: checking for previously cached test results of /usr/bin/qemu-system-
| arm, in /var/tmp/.guestfs-2596
| libguestfs: loading previously cached test results
| libguestfs: QMP parse error: parse error: premature EOF\n                                       \n                     (right here) ------^\n (ignored)
| libguestfs: qemu version: 2.11
| libguestfs: qemu mandatory locking: yes
| libguestfs: trace: get_sockdir
| libguestfs: trace: get_sockdir = "/tmp"
| libguestfs: finished testing qemu features
| libguestfs: trace: get_backend_setting "gdb"
| libguestfs: trace: get_backend_setting = NULL (error)
| libguestfs: command: run: dmesg | grep -Eoh 'lpj=[[:digit:]]+'
| dmesg: read kernel buffer failed: Operation not permitted
| libguestfs: read_lpj_from_dmesg: external command exited with error status 1
| libguestfs: read_lpj_from_files: no boot messages files are readable
| [00050ms] /usr/bin/qemu-system-arm \
|     -global virtio-blk-device.scsi=off \
|     -enable-fips \
|     -nodefaults \
|     -display none \
|     -machine virt,accel=kvm:tcg \
|     -m 500 \
|     -no-reboot \
|     -rtc driftfix=slew \
|     -kernel /var/tmp/.guestfs-2596/appliance.d/kernel \
|     -initrd /var/tmp/.guestfs-2596/appliance.d/initrd \
|     -object rng-random,filename=/dev/urandom,id=rng0 \
|     -device virtio-rng-pci,rng=rng0 \
|     -device virtio-scsi-device,id=scsi \
|     -drive file=/home/bengen/nbdkit-1.1.28/tests/test1.img,cache=writeback,format=raw,id=hd0,if=none \
|     -device scsi-hd,drive=hd0 \
|     -drive file=/var/tmp/.guestfs-2596/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none,format=raw \
|     -device scsi-hd,drive=appliance \
|     -device virtio-serial-device \
|     -serial stdio \
|     -chardev socket,path=/tmp/libguestfscc24gw/guestfsd.sock,id=channel0 \
|     -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
|     -append 'panic=1 mem=500M console=ttyAMA0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=screen'
| Could not access KVM kernel module: No such file or directory
| qemu-system-arm: failed to initialize KVM: No such file or directory
| qemu-system-arm: Back to tcg accelerator
| libguestfs: error: appliance closed the connection unexpectedly, see earlier error messages
| libguestfs: child_cleanup: 0x10e8ee8: child process died
| libguestfs: sending SIGTERM to process 14693
| libguestfs: error: /usr/bin/qemu-system-arm killed by signal 11 (Segmentation fault), see debug messages above
| libguestfs: error: guestfs_launch failed, see earlier error messages
| libguestfs: trace: launch = -1 (error)
| libguestfs: trace: close
| libguestfs: closing guestfs handle 0x10e8ee8 (state 0)
| libguestfs: command: run: rm
| libguestfs: command: run: \ -rf /tmp/libguestfsZiGbYj
| libguestfs: command: run: rm
| libguestfs: command: run: \ -rf /tmp/libguestfscc24gw
| Makefile:2396: recipe for target 'disk' failed
| make[2]: *** [disk] Error 1
| [...]
`----

Please let me know what I can do to provide further debugging help.

Cheers,
-Hilko

#888182#12
Date:
2018-01-24 14:06:18 UTC
From:
To:
The test failure looks like a problem in libguestfs (or maybe qemu)
rather than nbdkit.

TBH in Fedora we disable nbdkit tests on 32-bit armv7, 32-bit i686
and all POWER:

https://src.fedoraproject.org/rpms/nbdkit/blob/44518f07e0b28a799fa683f1f5ec2ca9c000ac01/f/nbdkit.spec#_419

Now that's not because they shouldn't work eventually, it's because we
don't routinely test nbdkit upstream on these architectures.

Rich.

#888182#17
Date:
2018-01-26 13:28:31 UTC
From:
To:
I was able to reproduce a crashing bug in qemu-system-arm on armv7
host.  I'm _not_ going to claim this is the same bug that Debian is
seeing, but it might be.

It's deep inside TCG and unfortunately there is not a lot of useful
information in the stack trace.  However it's clearly a bug in qemu.

Core was generated by `/usr/bin/qemu-system-arm -global virtio-blk-device.scsi=off -enable-fips -nodef'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xab6a7aa8 in ?? ()
[Current thread is 1 (Thread 0xaa9f7f90 (LWP 25252))]
(gdb) bt
#0  0xab6a7aa8 in ?? ()
#1  0xaba87ad0 in code_gen_buffer ()
#2  0x006291e0 in cpu_tb_exec (itb=<optimized out>, itb=<optimized out>,
    cpu=<optimized out>)
    at /usr/src/debug/qemu-2.11.0-4.fc28.arm/accel/tcg/cpu-exec.c:167
#3  cpu_loop_exec_tb (tb_exit=<synthetic pointer>,
    last_tb=<synthetic pointer>, tb=<optimized out>, cpu=<optimized out>)
    at /usr/src/debug/qemu-2.11.0-4.fc28.arm/accel/tcg/cpu-exec.c:627
#4  cpu_exec (cpu=<optimized out>)
    at /usr/src/debug/qemu-2.11.0-4.fc28.arm/accel/tcg/cpu-exec.c:736
#5  0x005efae4 in qemu_tcg_cpu_thread_fn (arg=0x13ce3e0)
    at /usr/src/debug/qemu-2.11.0-4.fc28.arm/cpus.c:1270
#6  0xb53f3f1c in start_thread () from /lib/libpthread.so.0
#7  0xb53790d8 in ?? () from /lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

I'm using:

* qemu-system-arm-2.11.0-4.fc28.armv7hl
* kernel-lpae-4.15.0-0.rc9.git2.1.fc28.armv7hl

Rich.

#888182#22
Date:
2018-02-06 18:50:38 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
nbdkit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 888182@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hilko Bengen <bengen@debian.org> (supplier of updated nbdkit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Feb 2018 18:59:38 +0100
Source: nbdkit
Binary: nbdkit nbdkit-plugin-dev nbdkit-plugin-perl nbdkit-plugin-python nbdkit-plugin-libvirt nbdkit-plugin-guestfs nbdkit-plugin-ruby
Architecture: source
Version: 1.1.28-3
Distribution: unstable
Urgency: medium
Maintainer: Hilko Bengen <bengen@debian.org>
Changed-By: Hilko Bengen <bengen@debian.org>
Description:
 nbdkit     - toolkit for creating NBD servers
 nbdkit-plugin-dev - development files for nbdkit
 nbdkit-plugin-guestfs - libguestfs plugin for nbdkit
 nbdkit-plugin-libvirt - libvirt plugin for nbdkit
 nbdkit-plugin-perl - Perl plugin for nbdkit
 nbdkit-plugin-python - Python plugin for nbdkit
 nbdkit-plugin-ruby - Ruby plugin for nbdkit
Closes: 888182
Changes:
 nbdkit (1.1.28-3) unstable; urgency=medium
 .
   * Document the need for linux-image-* build dependencies
     (Closes: #888182)
   * Disable some build dependencies for the nocheck build profile
Checksums-Sha1:
 c92c320e0f92effcb226b7c39343ff98f197d31a 3190 nbdkit_1.1.28-3.dsc
 cfb95bef27409f055ada6cfdce27a467201f4ad1 4724 nbdkit_1.1.28-3.debian.tar.xz
 c2cb8392dc792439088b36961dde89413052c860 14498 nbdkit_1.1.28-3_source.buildinfo
Checksums-Sha256:
 8000626b8674a6c2446a1ec1d177eba6efb70fd6823565074caac7137535cda3 3190 nbdkit_1.1.28-3.dsc
 a0937a86fbc97d4d85151396650ea6000daef03b6bba3abf5bb4a5026bc38bf3 4724 nbdkit_1.1.28-3.debian.tar.xz
 41e6b8699c1b421cbc5a3ea90d08388fb57499ebde55306b37f25cda832b7167 14498 nbdkit_1.1.28-3_source.buildinfo
Files:
 083eecad2c2863cb5e92eb301a5933e7 3190 admin optional nbdkit_1.1.28-3.dsc
 497a999285d1985c39a68386e79953fe 4724 admin optional nbdkit_1.1.28-3.debian.tar.xz
 09db5cba248c5359cd62d4bb342e88af 14498 admin optional nbdkit_1.1.28-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErnMQVUQqHZbPTUx4dbcQY1whOn4FAlp58wYACgkQdbcQY1wh
On6+5g/+N6YUuf6JL0GduUvDNySuRkvZ1oRgyV1QlC3bZuqOLAkF3gsFCveV2VPU
dSV9+53nb94YMgKCtunDlF0Ya2w1pmfjqO+NOmMHxik/gmCjAOrLZufnC5pEO6MG
aP2Zomb8A716LzLnRnV2GyJtLQbj2im3NjDBIR9O9CpeDq1FEVDhCj6EGhMqf7oa
fRqdyu/cpkioS1p99L6xONm5dqSMziX6TLV8xN6zLnQSHK95pAhsbv5UbyYz9fGK
6NtUoweNviP+a1XOTYSDiknHYULQmjJsmTOpMjKO3KUIc9lnR4KzRABA2jIGHB1T
sAWFsC56876/U/Xqb77znp/2ph1sHimRRG3vOBd5swEWBIqpL7T+fmyr7oC2pYHl
rQDJPbT69zMk+lNTNR9GndkSd62e8g7QTsmSd06M7flWbvfYP0K9T5XPNKmPefaZ
ToYTHw3TF/OuwKDlSY3r+z6hOxhEns2wzz44YrRWTaJdT+Hr7JQ8KjLG7sSJyRyS
AirriK1oEScT0+1UEOMKrK2tDCHxhyh57Iemvy0DjbKZe1YjcziM1CrlTL0q4uaA
OFTjl/u8ssU7G52D/aOpp3ymEqfSQ81Xqj4qzZtII2nMhl1UNbJ5PK5U1qk/cqAn
QTnTfbHHZMrjb+mc8MFcBKuvtT+++q2JTeEIUI5KFp7TsIEgeA0=
=5Hgx
-----END PGP SIGNATURE-----

#888182#27
Date:
2018-02-06 19:09:59 UTC
From:
To:
Sorry, I mixed up the bug number in the changelog. This ought to fix it.

Cheers,
-Hilko

#888182#36
Date:
2018-04-15 06:59:45 UTC
From:
To:
Hmm.. I've no idea why this bug has severity Grave to start with.

/mjt

#888182#43
Date:
2025-08-11 08:26:17 UTC
From:
To:
A *lot* has changed in qemu since version 2.11.
In particular, numerous testing/CI is being done in qemu-emulated
virtual machines everywhere.  So it looks like this issue has been
fixed long time ago.  At the very least, I can't reproduce this
crash anymore with bookworm versions of qemu and nbdkit (but I
didn't try hard).

Let's close this bug report with bookworm version of qemu.
Feel free to reopen it if you think it is incorrect.

Thanks,

/mjt