Bug 1534721

Summary:	backport fix for crash in NetworkManager when calling `ip route get`
Product:	Red Hat Enterprise Linux 7	Reporter:	Thomas Haller <thaller>
Component:	NetworkManager	Assignee:	Thomas Haller <thaller>
Status:	CLOSED ERRATA	QA Contact:	Desktop QE <desktop-qa-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.5	CC:	atragler, bgalvani, fgiudici, lmiksik, lrintel, rkhan, sukulkar, thaller, vbenes
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	NetworkManager-1.10.2-10.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-10 13:37:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Thomas Haller 2018-01-15 19:45:58 UTC

This fix:

https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c17315d555c812f8b14d36a34856f8030ecbfdc5

It used the wrong destroy function, which is quite possibly fatal. I didn't actually experience a crash, but I assume it can happen in certain circumstances.

Probably related to activating VPNs, because that is when we call the function.

Comment 4 Thomas Haller 2018-02-05 12:58:48 UTC

No, it was caught as a compiler error when doing https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d7025818123631e893948f389ab2ec428359b238

which changes:

-static void
-_nm_auto_nl_msg_cleanup (void *ptr)
+static inline void
+_nm_auto_nl_msg_cleanup (struct nl_msg **ptr)


It could be a bit hard to reproduce, because for that the netlink request RTM_GETROUTE would have to fail, so that we hit the error path and call the wrong free function.

It seems a pretty obvious bug. Dunno how hard it is to reproduce. Anyway, it's clearly fixed now, so SanityOnly seems very fine.

Comment 7 errata-xmlrpc 2018-04-10 13:37:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0778