qemu in sys-net-dm crashes in libc.so with some PCI Ethernet devices, pv mode and hvm with another Ethernet device works fine

[qubesuser]

Qubes OS version:

R4.0-rc2

Steps to reproduce the behavior:

1. Install Qubes
2. ??? (it apparently worked at first, but then stopped working after doing a bunch of work on the system, none of which seems an obvious culprit)
3. Try to start sys-net with a PCI Ethernet devices assigned (as hvm)

Expected behavior:

It starts.

Actual behavior:

It fails to start.

If the PCI devices are removed or virt_mode is set to pv, then it works properly.

Also, it seems it only happens for one of two of my Ethernet devices.

Hotplugging them also triggers the issue after rescanning the PCI bus with echo 1 > /sys/bus/pci/rescan

Connecting to sys-net-dm with xl console -t pv gives the following output (I just included the final lines), that seems to indicate qemu crashing in libc (haven't investigated which code is it, by guess would be a null pointer passed to memcpy/memset):

+ [ -f /tmp/qmp/res/a45b7ced-eef4-4ac3-b73c-d0cb25a9033e ]
+ cat /tmp/qmp/res/a45b7ced-eef4-4ac3-b73c-d0cb25a9033e
+ rm /tmp/qmp/res/a45b7ced-eef4-4ac3-b73c-d0cb25a9033e
+ slot_func=6,0
+ cut -d , -f 1
+ printf %s 6,0
+ slot=6
+ cut -d , -f 2
+ printf %s 6,0
+ func=0
+ vdevfn=48
+ printf 0x%02x 48
+ xenstore-write device-model/1/parameter 0x30
+ xenstore-write device-model/1/state pci-inserted
+ true
+ xenstore-watch -n 2 device-model/1/command
device-model/1/command
traps: qemu[44] general protection ip:7ff491476ef5 sp:7ff48f5a88e0 error:0 in libc-2.24.so[7ff4913f6000+1bd000]
u2mfn_release, priv=          (null)

+ setsid cttyhack sh
#
# pcifront pci-0: Rescanning PCI Frontend Bus 0000:00
pcifront pci-0: Rescanning PCI Frontend Bus 0000:00

[HW42]

(Very likely) fixed by QubesOS/qubes-vmm-xen-stubdom-linux#7.

[HW42]

(Very likely) fixed by QubesOS/qubes-vmm-xen-stubdom-linux#7.

[marmarek]

@qubesuser can you confirm it's fixed with current stubdom?

[marmarek]

@qubesuser can you confirm it's fixed with current stubdom?