Bug 1718172

Summary:	NULL pointer access in qemuProcessInitCpuAffinity()
Product:	Red Hat Enterprise Linux 7	Reporter:	Andrea Bolognani <abologna>
Component:	libvirt	Assignee:	Andrea Bolognani <abologna>
Status:	CLOSED ERRATA	QA Contact:	jiyan <jiyan>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.7	CC:	dyuan, fjin, jdenemar, jiyan, jomurphy, lhuang, lmen, mtessun, xuzhang
Target Milestone:	rc	Keywords:	Upstream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libvirt-4.5.0-22.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 13:14:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andrea Bolognani 2019-06-07 07:57:42 UTC

The fix for Bug 1703661 included, itself, a bug which will result in
a NULL pointer access. We should make sure RHEL 7.7 doesn't include
this bug when it ships.

A fix has already been committed upstream as

  commit a84922c09e9e1a0ca4f8fb1e8b4b1c7b55bd79e9
  Author: Andrea Bolognani <abologna>
  Date:   Thu Jun 6 15:38:29 2019 +0200

    qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity()

    Commit 2f2254c7f4e5 attempted to fix a memory leak by ensuring
    cpumapToSet is always a freshly allocated bitmap, but regrettably
    introduced a NULL pointer access while doing so, because it called
    virBitmapCopy() without allocating the destination bitmap first.

    Solve the issue by using virBitmapNewCopy() instead.

    Reported-by: John Ferlan <jferlan>
    Signed-off-by: Andrea Bolognani <abologna>
    Reviewed-by: Erik Skultety <eskultet>
    Reviewed-by: John Ferlan <jferlan>

  v5.4.0-55-ga84922c09e

so addressing this bug is going to be just a matter of backporting a
trivial patch.

Comment 6 Andrea Bolognani 2019-06-12 07:47:17 UTC

*** Bug 1719558 has been marked as a duplicate of this bug. ***

Comment 8 jiyan 2019-06-17 09:05:39 UTC

According to patch, this only affects emulatorpin.

Reproduced this issue on libvirt-4.5.0-21.el7.x86_64 by starting VM with emulatorpin conf

S1:
# virsh domstate q35
shut off

# virsh dumpxml q35 --inactive |grep "<vcpu" -A5
  <vcpu placement='static' current='5'>7</vcpu>
  <cputune>
    <emulatorpin cpuset='1-3'/>
  </cputune>

# virsh start q35
error: Disconnected from qemu:///system due to end of file
error: Failed to start domain q35
error: End of file while reading data: Input/output error


S2: 
# virsh domstate q35
shut off

# virsh dumpxml q35 --inactive |grep "<vcpu" -A2
  <vcpu placement='static' current='5'>7</vcpu>
  No emulatorpin conf
 
# virsh start q35
Domain q35 started

# virsh emulatorpin q35 1-3

# virsh emulatorpin q35 1-3 --config

# virsh destroy q35
Domain q35 destroyed

# virsh start q35
error: Disconnected from qemu:///system due to end of file
error: Failed to start domain q35
error: End of file while reading data: Input/output error

Comment 9 jiyan 2019-06-17 09:07:30 UTC

Verified this bug on libvirt-4.5.0-22.el7.x86_64

Version:
kernel-3.10.0-1056.el7.x86_64
libvirt-4.5.0-22.el7.x86_64
qemu-kvm-rhev-2.12.0-32.el7.x86_64

Steps:
1. Prepare a shutdown VM with the following conf
# virsh domstate q35
shut off

# virsh dumpxml q35|grep "<vcpu" -A3
  <vcpu placement='static'>7</vcpu>
  <cputune>
    <emulatorpin cpuset='1-3'/>
  </cputune>

2. Start the VM and check the emulatorpin info and related XML
# virsh start q35
Domain q35 started

# virsh emulatorpin q35
emulator: CPU Affinity
----------------------------------
       *: 1-3

# virsh dumpxml q35|grep "<vcpu" -A4
  <vcpu placement='static'>7</vcpu>
  <cputune>
    <emulatorpin cpuset='1-3'/>
  </cputune>

Comment 11 errata-xmlrpc 2019-08-06 13:14:55 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2294