Bug 1434882
| Summary: | Don't SIGSEGV on domain destroy | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Michal Privoznik <mprivozn> |
| Component: | libvirt | Assignee: | Michal Privoznik <mprivozn> |
| Status: | CLOSED ERRATA | QA Contact: | yalzhang <yalzhang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | dyuan, rbalakri, xuzhang |
| Target Milestone: | rc | Keywords: | Upstream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-3.2.0-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 17:24:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Michal Privoznik
2017-03-22 14:36:32 UTC
Patch proposed upstream: https://www.redhat.com/archives/libvir-list/2017-March/msg01004.html reproduce it on libvirt-3.1.0-2.el7.x86_64 # ps aux | grep libvirtd root 1366 0.6 0.3 1872896 29832 ? Ssl 16:28 0:01 /usr/sbin/libvirtd # virsh net-destroy default Network default destroyed # virsh destroy rhel7.3 error: Disconnected from qemu:///system due to I/O error error: Failed to destroy domain rhel7.3 error: End of file while reading data: Input/output error # ps aux | grep libvirtd root 5528 4.4 0.3 1946264 28464 ? Ssl 16:32 0:00 /usr/sbin/libvirtd Patch pushed upstream:
commit 2fe93123bfb6e3bc373b3cc70c60522235c9c931
Author: Michal Privoznik <mprivozn>
AuthorDate: Wed Mar 22 13:07:14 2017 +0100
Commit: Michal Privoznik <mprivozn>
CommitDate: Wed Mar 29 09:29:35 2017 +0200
network: Don't crash on domain destroy
https://bugzilla.redhat.com/show_bug.cgi?id=1434882
Imagine the following scenario:
1) virsh net-start default
2) virsh start myFavouriteDomain
3) virsh net-destroy default
4) virsh destroy myFavouriteDomain
(assuming myFavouriteDomain has an interface from default
network)
Regardless of how unlikely this scenario looks like, we should
not crash. The problem is, on net-destroy in
networkShutdownNetworkVirtual() the virMacMap module is unrefed,
but the stale pointer is kept around. Thus when the domain
destroy procedure comes in, networkReleaseActualDevice() and
subsequently networkMacMgrDel() is called. This function sees the
stale pointer and starts calling the virMacMap module APIs which
work over freed memory.
Signed-off-by: Michal Privoznik <mprivozn>
verified this bug on libvirt-3.2.0-1.el7.x86_64, the result is as expected, set this bug to verified.
1.
# virsh start rhel7.4
Domain rhel7.4 started
# virsh dumpxml rhel7.4 | grep /interface -B7
<interface type='network'>
<mac address='52:54:00:86:73:fa'/>
<source network='default' bridge='virbr0'/>
<target dev='vnet0'/>
<model type='virtio'/>
<alias name='net0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
# pidof libvirtd
2259
2. destroy the vm after the network in use is destroyed, libvirtd do not crash.
# virsh net-destroy default
Network default destroyed
# virsh destroy rhel7.4
Domain rhel7.4 destroyed
# pidof libvirtd
2259
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1846 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1846 |