Bug 1038816

Summary: libvirtd crash when create/destroy VM repeatedly
Product: Red Hat Enterprise Linux 6 Reporter: Chris Pelland <cpelland>
Component: libvirtAssignee: Michal Privoznik <mprivozn>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 6.5CC: acathrow, dallan, dyuan, eblake, mprivozn, mzhan, pm-eus, tlavigne, ydu, zhwang
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libvirt-0.10.2-29.el6_5.2 Doc Type: Bug Fix
Doc Text:
Cause: Two threads are working over the same domain. In fact, one is starting it, the other one is trying to destroy it. However, there is a race which can cause a domain to disappear in both threads leaving the start daemon access free()d memory. Consequence: The daemon crashes. Fix: The critical section was guarded by incrementing the reference counter of the domain. So whenver the domain is destroyed, the startup thread still holds the last reference which gets decremented once the startup process finishes. Result: The daemon crashes no more.
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-18 09:24:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1030736    
Bug Blocks:    

Description Chris Pelland 2013-12-05 21:14:11 UTC
This bug has been copied from bug #1030736 and has been proposed
to be backported to 6.5 z-stream (EUS).

Comment 7 yanbing du 2013-12-12 07:00:25 UTC
Verify this bug with libvirt-0.10.2-29.el6_5.2.x86_64.

Run the following commands:

   while /bin/true ; do virsh create demovm.xml ; virsh destroy demovm ; done

in 3 separate terminal windows.

After more than 10 mins, libvirtd still running and there's no orphaned QEMU process appear.

Comment 9 errata-xmlrpc 2013-12-18 09:24:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1856.html