BUG: SIGSEGV in audio_pcm_sw_write with Windows 7 SP 1

[Michał Leszczyński <michal.leszczynski@xxxxxxx>]

Hello,

I'm running the recent Xen master:
https://github.com/xen-project/xen/tree/d4ed1d4132f5825a795d5a78505811ecd2717b5e

when I install Windows 7 SP1, qemu-system-i386 crashes on the first attempt to 
use audio device (i.e. when Windows boots to the Desktop and tries to play the 
log-in sound).

Is there some regression in qemu which triggers for my configuration?

Enclosed: xl info, my xl.cfg and the crash report from GDB.


Best regards,
Michał Leszczyński
CERT Polska

---

root@zen2:/opt/win7# xl info
host                   : zen2
release                : 4.19.0-10-amd64
version                : #1 SMP Debian 4.19.132-1 (2020-07-24)
machine                : x86_64
nr_cpus                : 4
max_cpu_id             : 3
nr_nodes               : 1
cores_per_socket       : 4
threads_per_core       : 1
cpu_mhz                : 3000.227
hw_caps                : 
bfebfbff:76faf3bf:2c100800:00000121:0000000f:029c67af:00000000:00000100
virt_caps              : pv hvm hvm_directio pv_directio hap shadow 
iommu_hap_pt_share
total_memory           : 16292
free_memory            : 4687
sharing_freed_memory   : 0
sharing_used_memory    : 0
outstanding_claims     : 0
free_cpus              : 0
xen_major              : 4
xen_minor              : 15
xen_extra              : -unstable
xen_version            : 4.15-unstable
xen_caps               : xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 
hvm-3.0-x86_32p hvm-3.0-x86_64 
xen_scheduler          : credit2
xen_pagesize           : 4096
platform_params        : virt_start=0xffff800000000000
xen_changeset          : 
xen_commandline        : placeholder dom0_mem=8192M,max:8192M dom0_max_vcpus=4 
dom0_vcpus_pin=1 force-ept=1 ept=pml=0 hap_1gb=0 hap_2mb=0 altp2m=1 smt=0
cc_compiler            : gcc (Debian 8.3.0-6) 8.3.0
cc_compile_by          : root
cc_compile_domain      : cert.pl
cc_compile_date        : Thu Oct  1 17:00:45 CEST 2020
build_id               : caeeb34d88d2f2bafc724be963a70ef68a9a552a
xend_config_format     : 4

---

arch = 'x86_64'
name = "vm-0"
maxmem = 3048
memory = 3048
vcpus = 2
maxvcpus = 2
builder = "hvm"
boot = "cd,menu=on,splash=/usr/share/drakrun/splash.jpg,splash-time=2000"
hap = 1
acpi = 1
on_poweroff = "destroy"
on_reboot = "restart"
on_crash = "destroy"
vnc=1
vnclisten="0.0.0.0:0,websocket=6400"
vncpasswd="sth123"
usb = 1
usbdevice = "tablet"
altp2m = 2
shadow_memory = 16
audio = 1
soundhw='hda'
cpuid="host,htt=0"
vga="stdvga"
vif = [ 'type=ioemu,model=e1000,bridge=drak0' ]
disk = [ "tap:qcow2:/var/lib/drakrun/volumes/vm-0.img,xvda,w", 
"file:/opt/win7/SW_DVD5_Win_Pro_7w_SP1_64BIT_Polish_-2_MLF_X17-59386.ISO,hdc:cdrom,r",
 "file:/var/lib/drakrun/volumes/unattended.iso,hdd:cdrom,r" ]
processor_trace_buf_kb=65536

---

Thread 1 "qemu-system-i38" received signal SIGSEGV, Segmentation fault.
audio_pcm_sw_write (sw=0x556c610f5330, buf=0x0, size=1612) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:739           
                                                            
739             if (!sw->hw->pcm_ops->volume_out) {
(gdb) bt
#0  0x0000556c5e4716cb in audio_pcm_sw_write (sw=0x556c610f5330, buf=0x0, 
size=1612) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:739           
                                  
#1  0x0000556c5e47463e in audio_capture_mix_and_clear (hw=0x556c60f1c440, 
rpos=0, samples=403) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1069          
                        
#2  0x0000556c5e474c44 in audio_run_out (s=0x556c60f1c170) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1203          
                                                            
#3  0x0000556c5e47546e in audio_run (s=0x556c60f1c170, msg=0x556c5e9bf238 
"timer") at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1372          
                                    
#4  0x0000556c5e473f35 in audio_timer (opaque=0x556c60f1c170) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:846           
                                                         
#5  0x0000556c5e85f6a5 in timerlist_run_timers (timer_list=0x556c60557500) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:587       
                                            
#6  0x0000556c5e85f74f in qemu_clock_run_timers (type=QEMU_CLOCK_VIRTUAL) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:601       
                                             
#7  0x0000556c5e85fa0f in qemu_clock_run_all_timers () at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:687       
                                                                
#8  0x0000556c5e860384 in main_loop_wait (nonblocking=0) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/main-loop.c:573        
                                                              
#9  0x0000556c5e3f1dfc in qemu_main_loop () at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/softmmu/vl.c:1664           
                                                                           
#10 0x0000556c5e7fda31 in main (argc=45, argv=0x7ffea849a5a8, 
envp=0x7ffea849a718) at 
/opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/softmmu/main.c:49           
                                    
(gdb)
#0  0x0000556c5e4716cb in audio_pcm_sw_write (sw=0x556c610f5330, buf=0x0, 
size=1612)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:739
#1  0x0000556c5e47463e in audio_capture_mix_and_clear (hw=0x556c60f1c440, 
rpos=0, samples=403)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1069
#2  0x0000556c5e474c44 in audio_run_out (s=0x556c60f1c170)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1203
#3  0x0000556c5e47546e in audio_run (s=0x556c60f1c170, msg=0x556c5e9bf238 
"timer")
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:1372
#4  0x0000556c5e473f35 in audio_timer (opaque=0x556c60f1c170)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/audio/audio.c:846
#5  0x0000556c5e85f6a5 in timerlist_run_timers (timer_list=0x556c60557500)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:587
#6  0x0000556c5e85f74f in qemu_clock_run_timers (type=QEMU_CLOCK_VIRTUAL)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:601
#7  0x0000556c5e85fa0f in qemu_clock_run_all_timers ()
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/qemu-timer.c:687
#8  0x0000556c5e860384 in main_loop_wait (nonblocking=0)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/util/main-loop.c:573
#9  0x0000556c5e3f1dfc in qemu_main_loop ()
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/softmmu/vl.c:1664
#10 0x0000556c5e7fda31 in main (argc=45, argv=0x7ffea849a5a8, 
envp=0x7ffea849a718)
    at /opt/drakvuf-sandbox/drakvuf/xen/tools/qemu-xen-dir/softmmu/main.c:49