Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-101163

qemu-kvm crashed when starting guest with ethernet and multi-queues interface

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • rhel-security-selinux
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None
    • None
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      Set vm with ethernet and multi-queue interface, vm start successfully but shutdown automatically after a while , and then qemu crash

      Please provide the package NVR for which the bug is seen:

       

      #rpm -q libvirt qemu-kvm ;uname -r
      libvirt-10.10.0-13.el9.x86_64
      qemu-kvm-9.1.0-24.el9.x86_64
      5.14.0-595.el9.x86_64
      

      How reproducible is this bug?: 100%

      Steps to reproduce

      1.Set vm with ethernet and multi-queue interface

       

      ~]# tmux -c "ip link add name br0 type bridge; ip link set eno1 up; ip link set eno1 master br0; ip link set br0 up; pkill dhclient; dhclient br0"
      ~]# ip tuntap add mode tap user test group test name mytap0  multi_queue
      ~]# ip link set mytap0 up
      ~]# ip link set mytap0 master br0
      ~]# machinectl shell test@
      Connected to the local host. Press ^] three times within 1s to exit session.   
      
      [test@dell-***]  virsh dumpxml vm3 --xpath //interface
      <interface type="ethernet">
        <mac address="52:54:00:99:94:49"/>
        <target dev="mytap0" managed="no"/>
        <model type="virtio"/>
        <driver queues="2"/>
        <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
      </interface>
       
      

      2.Start vm 

      [test@dell-***]$ virsh start vm3
      Domain 'vm3' started

      Expected results

      vm is running all the time

      Actual results:

      vm is running for a while , but turn to be shutoff

      [test@dell-***]$ virsh list --all
       Id   Name   State
      -----------------------
       -    vm3    shut off

       

      qemu log --the whole log is in the attachment.

      #cat /home/test/.cache/libvirt/qemu/log/vm3.log
      ....
      -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.5","addr":"0x0"}' \
      -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \
      -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.6","addr":"0x0"}' \
      -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
      -msg timestamp=on
       
      
      char device redirected to /dev/pts/3 (label charserial0)
      2025-07-01T03:17:59.797447Z qemu-kvm: could not enable queue
      qemu-kvm: ../hw/net/virtio-net.c:744: void virtio_net_set_queue_pairs(VirtIONet *): Assertion `!r' failed.
      2025-07-01 03:18:00.083+0000: shutting down, reason=crashed
      ]# 
      

       

      Coredump

       

      ]# coredumpctl 
      TIME                          PID  UID  GID SIG     COREFILE EXE                   SIZE
      Mon 2025-06-30 23:17:59 EDT 64773 1000 1000 SIGABRT none     /usr/libexec/qemu-kvm    -
      ~]# coredumpctl gdb 64773
                 PID: 64773 (qemu-kvm)
                 UID: 1000 (test)
                 GID: 1000 (test)
              Signal: 6 (ABRT)
           Timestamp: Mon 2025-06-30 23:17:59 EDT (51s ago)
        Command Line: /usr/libexec/qemu-kvm -name guest=vm3,debug-threads=on -S -object $'{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/home/test/.config/libvirt/qemu/lib/domain-2-vm3/master-key.aes"}' -blockdev $'{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' -blockdev $'{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' -blockdev $'{"driver":"file","filename":"/home/test/.config/libvirt/qemu/nvram/vm3_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' -machine pc-q35-rhel9.6.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,hpet=off,acpi=on -accel kvm -cpu Haswell-noTSX-IBRS,vmx=on,pdcm=on,f16c=on,rdrand=on,hypervisor=on,vme=on,ss=on,arat=on,tsc-adjust=on,umip=on,md-clear=on,stibp=on,flush-l1d=on,arch-capabilities=on,ssbd=on,xsaveopt=on,abm=on,pdpe1gb=on,ibpb=on,ibrs=on,amd-stibp=on,amd-ssbd=on,skip-l1dfl-vmentry=on,pschange-mc-no=on,gds-no=on,rfds-no=on,vmx-ins-outs=on,vmx-true-ctls=on,vmx-store-lma=on,vmx-activity-hlt=on,vmx-activity-wait-sipi=on,vmx-vmwrite-vmexit-fields=on,vmx-apicv-xapic=on,vmx-ept=on,vmx-desc-exit=on,vmx-rdtscp-exit=on,vmx-apicv-x2apic=on,vmx-vpid=on,vmx-wbinvd-exit=on,vmx-unrestricted-guest=on,vmx-apicv-register=on,vmx-apicv-vid=on,vmx-rdrand-exit=on,vmx-invpcid-exit=on,vmx-vmfunc=on,vmx-shadow-vmcs=on,vmx-pml=on,vmx-ept-execonly=on,vmx-page-walk-4=on,vmx-ept-2mb=on,vmx-ept-1gb=on,vmx-invept=on,vmx-eptad=on,vmx-invept-single-context=on,vmx-invept-all-context=on,vmx-invvpid=on,vmx-invvpid-single-addr=on,vmx-invvpid-all-context=on,vmx-invept-single-context-noglobals=on,vmx-intr-exit=on,vmx-nmi-exit=on,vmx-vnmi=on,vmx-preemption-timer=on,vmx-posted-intr=on,vmx-vintr-pending=on,vmx-tsc-offset=on,vmx-hlt-exit=on,vmx-invlpg-exit=on,vmx-mwait-exit=on,vmx-rdpmc-exit=on,vmx-rdtsc-exit=on,vmx-cr3-load-noexit=on,vmx-cr3-store-noexit=on,vmx-cr8-load-exit=on,vmx-cr8-store-exit=on,vmx-flexpriority=on,vmx-vnmi-pending=on,vmx-movdr-exit=on,vmx-io-exit=on,vmx-io-bitmap=on,vmx-mtf=on,vmx-msr-bitmap=on,vmx-monitor-exit=on,vmx-pause-exit=on,vmx-secondary-ctls=on,vmx-exit-nosave-debugctl=on,vmx-exit-load-perf-global-ctrl=on,vmx-exit-ack-intr=on,vmx-exit-save-pat=on,vmx-exit-load-pat=on,vmx-exit-save-efer=on,vmx-exit-load-efer=on,vmx-exit-save-preemption-timer=on,vmx-entry-noload-debugctl=on,vmx-entry-ia32e-mode=on,vmx-entry-load-perf-global-ctrl=on,vmx-entry-load-pat=on,vmx-entry-load-efer=on,vmx-eptp-switching=on -global driver=cfi.pflash01,property=secure,value=on -m size=2097152k -object $'{"qom-type":"memory-backend-ram","id":"pc.ram","size":2147483648}' -overcommit mem-lock=off -smp 2,sockets=2,cores=1,threads=1 -uuid 1a59f92d-8811-4777-bb58-07821946ff6d -no-user-config -nodefaults -chardev socket,id=charmonitor,fd=23,server=on,wait=off -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-shutdown -global ICH9-LPC.disable_s3=1 -global ICH9-LPC.disable_s4=1 -boot strict=on -device $'{"driver":"pcie-root-port","port":16,"chassis":1,"id":"pci.1","bus":"pcie.0","multifunction":true,"addr":"0x2"}' -device $'{"driver":"pcie-root-port","port":17,"chassis":2,"id":"pci.2","bus":"pcie.0","addr":"0x2.0x1"}' -device $'{"driver":"pcie-root-port","port":18,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x2.0x2"}' -device $'{"driver":"pcie-root-port","port":19,"chassis":4,"id":"pci.4","bus":"pcie.0","addr":"0x2.0x3"}' -device $'{"driver":"pcie-root-port","port":20,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x2.0x4"}' -device $'{"driver":"pcie-root-port","port":21,"chassis":6,"id":"pci.6","bus":"pcie.0","addr":"0x2.0x5"}' -device $'{"driver":"pcie-root-port","port":22,"chassis":7,"id":"pci.7","bus":"pcie.0","addr":"0x2.0x6"}' -device $'{"driver":"pcie-root-port","port":23,"chassis":8,"id":"pci.8","bus":"pcie.0","addr":"0x2.0x7"}' -device $'{"driver":"pcie-root-port","port":24,"chassis":9,"id":"pci.9","bus":"pcie.0","multifunction":true,"addr":"0x3"}' -device $'{"driver":"pcie-root-port","port":25,"chassis":10,"id":"pci.10","bus":"pcie.0","addr":"0x3.0x1"}' -device $'{"driver":"pcie-root-port","port":26,"chassis":11,"id":"pci.11","bus":"pcie.0","addr":"0x3.0x2"}' -device $'{"driver":"pcie-root-port","port":27,"chassis":12,"id":"pci.12","bus":"pcie.0","addr":"0x3.0x3"}' -device $'{"driver":"pcie-root-port","port":28,"chassis":13,"id":"pci.13","bus":"pcie.0","addr":"0x3.0x4"}' -device $'{"driver":"pcie-root-port","port":29,"chassis":14,"id":"pci.14","bus":"pcie.0","addr":"0x3.0x5"}' -device $'{"driver":"qemu-xhci","p2":15,"p3":15,"id":"usb","bus":"pci.2","addr":"0x0"}' -device $'{"driver":"virtio-serial-pci","id":"virtio-serial0","bus":"pci.3","addr":"0x0"}' -blockdev $'{"driver":"file","filename":"/home/test/RHEL-9.4.0-20240527.75-x86_64-ovmf.qcow2","aio":"native","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap","cache":{"direct":true,"no-flush":false}}' -blockdev $'{"node-name":"libvirt-1-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","file":"libvirt-1-storage","backing":null}' -device $'{"driver":"virtio-blk-pci","bus":"pci.4","addr":"0x0","drive":"libvirt-1-format","id":"virtio-disk0","bootindex":1,"write-cache":"on"}' -netdev $'{"type":"tap","fds":"24:26","vhost":true,"vhostfds":"27:28","id":"hostnet0"}' -device $'{"driver":"virtio-net-pci","mq":true,"vectors":6,"netdev":"hostnet0","id":"net0","mac":"52:54:00:99:94:49","bus":"pci.1","addr":"0x0"}' -chardev pty,id=charserial0 -device $'{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' -chardev socket,id=charchannel0,fd=22,server=on,wait=off -device $'{"driver":"virtserialport","bus":"virtio-serial0.0","nr":1,"chardev":"charchannel0","id":"channel0","name":"org.qemu.guest_agent.0"}' -chardev socket,id=chrtpm,path=/run/user/1000/libvirt/qemu/run/swtpm/2-vm3-swtpm.sock -tpmdev emulator,id=tpm-tpm0,chardev=chrtpm -device $'{"driver":"tpm-crb","tpmdev":"tpm-tpm0","id":"tpm0"}' -device $'{"driver":"usb-tablet","id":"input0","bus":"usb.0","port":"1"}' -audiodev $'{"id":"audio1","driver":"none"}' -vnc 127.0.0.1:0,audiodev=audio1 -device $'{"driver":"virtio-vga","id":"video0","max_outputs":1,"bus":"pcie.0","addr":"0x1"}' -global ICH9-LPC.noreboot=off -watchdog-action reset -device $'{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.5","addr":"0x0"}' -object $'{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' -device $'{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.6","addr":"0x0"}' -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny -msg timestamp=on
          Executable: /usr/libexec/qemu-kvm
       Control Group: /user.slice/user-1000.slice/session-4.scope
                Unit: session-4.scope
               Slice: user-1000.slice
             Session: 4
           Owner UID: 1000 (test)
             Boot ID: 2816bcdd654d4fb89c4e13059c9f32fb
          Machine ID: bf17b9e06bf945e4a31caf14b4322d41
            Hostname: dell-r730-018.bkr.lab.eng.rdu2.dc.redhat.com
             Storage: none
             Message: Process 64773 (qemu-kvm) of user 1000 dumped core.
      Coredump entry has no core attached (neither internally in the journal nor externally on disk).
      

       

      ausearch 

      ~]# ausearch -m avc
      ----
      time->Mon Jun 30 23:17:10 2025
      type=PROCTITLE msg=audit(1751339830.785:514): proctitle=2F7573722F62696E2F737774706D00736F636B6574002D2D6374726C00747970653D756E6978696F2C706174683D2F72756E2F757365722F313030302F6C6962766972742F71656D752F72756E2F737774706D2F312D766D332D737774706D2E736F636B2C6D6F64653D30363030002D2D74706D7374617465006469723D2F68
      type=SYSCALL msg=audit(1751339830.785:514): arch=c000003e syscall=87 success=no exit=-13 a0=55cb6aaf2e20 a1=0 a2=1 a3=8 items=0 ppid=1 pid=64735 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4 comm="swtpm" exe="/usr/bin/swtpm" subj=unconfined_u:unconfined_r:svirt_t:s0:c354,c451 key=(null)
      type=AVC msg=audit(1751339830.785:514): avc:  denied  { unlink } for  pid=64735 comm="swtpm" name="1-vm3-swtpm.sock" dev="tmpfs" ino=85 scontext=unconfined_u:unconfined_r:svirt_t:s0:c354,c451 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=0
      ----
      time->Mon Jun 30 23:17:59 2025
      type=PROCTITLE msg=audit(1751339879.795:519): proctitle=2F7573722F6C6962657865632F71656D752D6B766D002D6E616D650067756573743D766D332C64656275672D746872656164733D6F6E002D53002D6F626A656374007B22716F6D2D74797065223A22736563726574222C226964223A226D61737465724B657930222C22666F726D6174223A22726177222C2266696C65223A22
      type=SYSCALL msg=audit(1751339879.795:519): arch=c000003e syscall=16 success=no exit=-13 a0=1a a1=400454d9 a2=7f58b26bad70 a3=0 items=0 ppid=1 pid=64773 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4 comm=43505520302F4B564D exe="/usr/libexec/qemu-kvm" subj=unconfined_u:unconfined_r:svirt_t:s0:c399,c929 key=(null)
      type=AVC msg=audit(1751339879.795:519): avc:  denied  { attach_queue } for  pid=64773 comm=43505520302F4B564D scontext=unconfined_u:unconfined_r:svirt_t:s0:c399,c929 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tun_socket permissive=0

              rhn-support-zpytela Zdenek Pytela
              nanli@redhat.com Nannan Li
              Zdenek Pytela Zdenek Pytela
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              17 Start watching this issue

                Created:
                Updated: