QEMU crash when execute device_add and device_del alternately

[saranzhou]

When execute device_add and device_del alternately, qemu crashes:
[root@localhost coredump]# virsh qemu-monitor-command testvm --hmp 'device_add vfio-user-pci,socket=/var/run/cntrl,id=testdisk0'
[root@localhost coredump]# virsh qemu-monitor-command testvm --hmp 'device_del testdisk0'
[root@localhost coredump]# virsh qemu-monitor-command testvm --hmp 'device_add vfio-user-pci,socket=/var/run/cntrl,id=testdisk0'
[root@localhost coredump]# virsh qemu-monitor-command testvm --hmp 'device_del testdisk0'
[root@localhost coredump]# virsh qemu-monitor-command testvm --hmp 'device_add vfio-user-pci,socket=/var/run/cntrl,id=testdisk0'
error: Unable to read from monitor: Connection reset by peer

And the coredump stack as follows:

thread_all_bt.log
I have repetitioned for several times, and QEMU always crashes in flatview_destroy process.

oracle qemu branch: vfio-user-dbfix
spdk branch: V22.01

Has anyone ever encountered a similar issue? thanks a lot🙂

[saranzhou]

Is there an out-of-bounds memory access?

[tmakatos]

@saranzhou you'd better raise an issue at https://github.com/oracle/qemu, we don't maintain QEMU in this repository.

Aside from that, have you tested the latest version of vfio-user client sent by John Johnsons at qemu-devel?

CC @jraman567