Bug 1444408

Summary: starting guest with graphics device set to listen on network crashes libvirtd
Product: Red Hat Enterprise Linux 7 Reporter: Pavel Hrdina <phrdina>
Component: libvirtAssignee: Pavel Hrdina <phrdina>
Status: CLOSED ERRATA QA Contact: Fangge Jin <fjin>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.3CC: rbalakri, xuzhang
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libvirt-3.2.0-4.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-02 00:05:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pavel Hrdina 2017-04-21 09:57:06 UTC
Description of problem:

If there is a network interface on a host without any IP address and it's placed before the interface used for graphics device libvirtd will crash:


Thread 1 (Thread 0x7f194b99d700 (LWP 5631)):
0  virNetDevGetifaddrsAddress (addr=0x7f194b99c7c0, ifname=0x7f193400e2b0 "ovirtmgmt") at util/virnetdevip.c:738
1  virNetDevIPAddrGet (ifname=0x7f193400e2b0 "ovirtmgmt", addr=addr@entry=0x7f194b99c7c0) at util/virnetdevip.c:795
2  0x00007f19467800d6 in networkGetNetworkAddress (netname=<optimized out>, netaddr=netaddr@entry=0x7f1924013f18) at network/bridge_driver.c:4780
3  0x00007f193e43a33c in qemuProcessGraphicsSetupNetworkAddress (listenAddr=0x7f19340f7650 "127.0.0.1", glisten=0x7f1924013f10) at qemu/qemu_process.c:4062
4  qemuProcessGraphicsSetupListen (vm=<optimized out>, graphics=0x7f1924014f10, cfg=0x7f1934119f00) at qemu/qemu_process.c:4133
5  qemuProcessSetupGraphics (flags=17, vm=0x7f19240155d0, driver=0x7f193411f1d0) at qemu/qemu_process.c:4196
6  qemuProcessPrepareDomain (conn=conn@entry=0x7f192c00ab50, driver=driver@entry=0x7f193411f1d0, vm=vm@entry=0x7f19240155d0, flags=flags@entry=17) at qemu/qemu_process.c:4969
7  0x00007f193e4417c0 in qemuProcessStart (conn=conn@entry=0x7f192c00ab50, driver=driver@entry=0x7f193411f1d0,vm=0x7f19240155d0,asyncJob=asyncJob@entry=QEMU_ASYNC_JOB_START, migrateFrom=migrateFrom@entry=0x0, migrateFd=migrateFd@entry=-1,migratePath=migratePath@entry=0x0,snapshot=snapshot@entry=0x0, vmop=vmop@entry=VIR_NETDEV_VPORT_PROFILE_OP_CREATE, flags=17, flags@entry=1) at qemu/qemu_process.c:5553

Version-Release number of selected component (if applicable):
libvirt-daemon-2.0.0-10.el7_3.5.x86_64


Steps to Reproduce:
1. Create a new tun0 interface without any IP address
  $ ip tuntap add mode tun dev tun0

2. Create a new testbr bridge interface
  $ brctl addbr testbr

3. Define and start new network in libvirt
  $ cat testbr.xml

<network>
  <name>testbr</name>
  <forward mode='bridge'/>
  <bridge name='testbr'/>
</network>

  $ virsh net-define testbr.xml
  $ virsh net-start testbr.xml

4. Create a new guest with this graphics configuration:

  ...
  <graphics type='spice' autoport='yes'>
    <listen type='network' network='testbr'/>
  </graphics>

5. Start the guest
  $ virsh start GUEST_NAME

Comment 2 Pavel Hrdina 2017-04-21 11:11:12 UTC
Upstream commit:

commit 42000bf7e554b3732a569db633824302d5ec2867
Author: Pavel Hrdina <phrdina>
Date:   Fri Apr 21 10:50:12 2017 +0200

    util: check ifa_addr pointer before accessing its elements

Comment 5 Fangge Jin 2017-05-05 11:18:22 UTC
Reproduce with build libvirt-3.2.0-3.virtcov.el7.x86_64

Verify with build libvirt-3.2.0-4.virtcov.el7.x86_64

Steps are same as comment 0, libvirtd doesn't crash.

Comment 6 errata-xmlrpc 2017-08-02 00:05:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1846

Comment 7 errata-xmlrpc 2017-08-02 01:30:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1846