Bug 1434278

Summary: libvirtd crash when hotplug a serial dev with --config
Product: Red Hat Enterprise Linux 7 Reporter: Pei Zhang <pzhang>
Component: libvirtAssignee: Erik Skultety <eskultet>
Status: CLOSED ERRATA QA Contact: Jing Qi <jinqi>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: dyuan, hhan, jsuchane, pzhang, rbalakri, xuzhang, yafu, yalzhang
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libvirt-3.2.0-9.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-01 17:24:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pei Zhang 2017-03-21 07:29:09 UTC
Description of problem:
libvirtd crash when hotplug a serial dev with --config 

Version-Release number of selected component (if applicable):
libvirt-3.1.0-2.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. having a serial dev as following 
# cat serial.xml 
<serial type='dev'>
      <source path='/dev/ttyS0'/>
      <target port='0'/>
    </serial>

2. do hotplug with --config
# virsh list 
 Id    Name                           State
----------------------------------------------------
 16    vm2                            running

# virsh attach-device vm2 serial.xml --config
error: Disconnected from qemu:///system due to I/O error
error: Failed to attach device from serial.xml
error: End of file while reading data: Input/output error


Actual results:
libvirtd crash

Expected results:
libvirtd will not crash

Additional info:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f9cd757f700 (LWP 24622)]
virDomainChrSourceDefIsEqual (src=0x7f9cc0000990, tgt=0x0) at conf/domain_conf.c:2070
2070	    if (tgt->type != src->type)
(gdb) bt
#0  virDomainChrSourceDefIsEqual (src=0x7f9cc0000990, tgt=0x0) at conf/domain_conf.c:2070
#1  0x00007f9ce80cdbca in virDomainDefAddConsoleCompat (def=0x7f9cc00133f0) at conf/domain_conf.c:3897
#2  virDomainDefAddImplicitDevices (def=def@entry=0x7f9cc00133f0) at conf/domain_conf.c:20193
#3  0x00007f9ce80ceacd in virDomainDefPostParseInternal (data=0x7f9cd757e840, def=0x7f9cc00133f0) at conf/domain_conf.c:4614
#4  virDomainDefPostParse (def=def@entry=0x7f9cc00133f0, caps=caps@entry=0x7f9c74235b20, parseFlags=parseFlags@entry=514, xmlopt=xmlopt@entry=0x7f9c742fd3b0, 
    parseOpaque=parseOpaque@entry=0x0) at conf/domain_conf.c:4679
#5  0x00007f9c9364679b in qemuDomainAttachDeviceConfig (parse_flags=514, xmlopt=0x7f9c742fd3b0, caps=0x7f9c74235b20, conn=0x7f9ccc000b10, dev=0x7f9cc0002900, 
    vmdef=<optimized out>) at qemu/qemu_driver.c:7751
#6  qemuDomainAttachDeviceLiveAndConfig (flags=2, xml=<optimized out>, driver=0x7f9c74106df0, vm=0x7f9c742f8f00, conn=0x7f9ccc000b10) at qemu/qemu_driver.c:8059
#7  qemuDomainAttachDeviceFlags (dom=<optimized out>, xml=<optimized out>, flags=2) at qemu/qemu_driver.c:8126
#8  0x00007f9ce817bcd7 in virDomainAttachDeviceFlags (domain=domain@entry=0x7f9cc0000bd0, 
    xml=0x7f9cc0000c40 "<serial type='dev'>\n      <source path='/dev/ttyS0'/>\n      <target port='0'/>\n    </serial>\n", flags=2) at libvirt-domain.c:8156
#9  0x00007f9ce8fed2a5 in remoteDispatchDomainAttachDeviceFlags (server=0x7f9ceb12b390, msg=0x7f9ceb1545e0, args=0x7f9cc00008c0, rerr=0x7f9cd757ec00, 
    client=<optimized out>) at remote_dispatch.h:3514
#10 remoteDispatchDomainAttachDeviceFlagsHelper (server=0x7f9ceb12b390, client=<optimized out>, msg=0x7f9ceb1545e0, rerr=0x7f9cd757ec00, args=0x7f9cc00008c0, 
    ret=0x7f9cc0000c20) at remote_dispatch.h:3490
#11 0x00007f9ce820977c in virNetServerProgramDispatchCall (msg=0x7f9ceb1545e0, client=0x7f9ceb1537a0, server=0x7f9ceb12b390, prog=0x7f9ceb14e950)
    at rpc/virnetserverprogram.c:437
#12 virNetServerProgramDispatch (prog=0x7f9ceb14e950, server=server@entry=0x7f9ceb12b390, client=client@entry=0x7f9ceb1537a0, msg=msg@entry=0x7f9ceb1545e0)
    at rpc/virnetserverprogram.c:307
#13 0x00007f9ce901ac3a in virNetServerProcessMsg (srv=srv@entry=0x7f9ceb12b390, client=0x7f9ceb1537a0, prog=<optimized out>, msg=0x7f9ceb1545e0) at rpc/virnetserver.c:148
#14 0x00007f9ce901b038 in virNetServerHandleJob (jobOpaque=<optimized out>, opaque=0x7f9ceb12b390) at rpc/virnetserver.c:169
#15 0x00007f9ce8083fa1 in virThreadPoolWorker (opaque=opaque@entry=0x7f9ceb120160) at util/virthreadpool.c:167
#16 0x00007f9ce8082d70 in virThreadHelper (data=<optimized out>) at util/virthread.c:206
#17 0x00007f9ce51a7dc5 in start_thread () from /lib64/libpthread.so.0
#18 0x00007f9ce4ed673d in clone () from /lib64/libc.so.6

Comment 2 Jaroslav Suchanek 2017-04-05 08:55:10 UTC
I do not see a crash using libvirt-3.2.0-1.el7.x86_64. Can you please re-try with that build? Thanks.

Comment 3 Pei Zhang 2017-04-06 05:35:21 UTC
Hi,
I tried with libvirt-3.2.0-1.el7.x86_64.
And I found 

A crash will happen if there is no serial device in guest XML configuration. 

It can attach successfully if the running guest already has serial devices. 

Thanks.

Comment 5 Erik Skultety 2017-06-07 12:24:32 UTC
Upstream fix:
commit ff6e94de60b081ae7e9d304e38c63346828c5dbe
Refs: v3.4.0-59-gff6e94de6
Author:     Erik Skultety <eskultet>
AuthorDate: Mon May 29 12:58:34 2017 +0200
Commit:     Erik Skultety <eskultet>
CommitDate: Wed Jun 7 14:17:56 2017 +0200

    qemu: Fix serial stub console allocation

    When adding the aliased serial stub console, the structure wasn't
    properly allocated (VIR_ALLOC instead of virDomainChrDefNew) which then
    resulted in SIGSEGV in virDomainChrSourceIsEqual during a serial device
    coldplug.

    https://bugzilla.redhat.com/show_bug.cgi?id=1434278

    Signed-off-by: Erik Skultety <eskultet>

Comment 8 Jing Qi 2017-06-09 02:31:39 UTC
Verified with libvirt-3.2.0-9.el7.x86_64 and qemu-kvm-rhev-2.9.0-7.el7.x86_64

# virsh start rhel7
error: Failed to start domain rhel7
error: XML error: need at least one serial port to use SGA

# virsh attach-device rhel7 serial.xml --config
Device attached successfully

No crash happened. Then start the vm again.

# virsh start rhel7
Domain rhel7 started

Comment 9 errata-xmlrpc 2017-08-01 17:24:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1846

Comment 10 errata-xmlrpc 2017-08-02 00:03:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1846