Bug 2039651

Summary: [snapshot] snapshot metadata lost when redefine snapshot with --current
Product: Red Hat Enterprise Linux 9 Reporter: yisun
Component: libvirtAssignee: Peter Krempa <pkrempa>
libvirt sub component: General QA Contact: liang cong <lcong>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: unspecified CC: jdenemar, lmen, pkrempa, virt-maint, xuzhang
Version: 9.0Keywords: Automation, Regression, Triaged
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libvirt-8.0.0-1.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-05-17 12:46:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version: 8.0.0
Embargoed:

Description yisun 2022-01-12 07:21:38 UTC
Description of problem:
[snapshot] snapshot metadata lost when redefine snapshot with --current

Version-Release number of selected component (if applicable):
libvirt-8.0.0-0rc1.1.el9.x86_64

How reproducible:
100%

Steps to Reproduce:
1. have a running vm
root@dell-per740-08 ~]# virsh start vm1
Domain 'vm1' started

2. create a snapshot for it
[root@dell-per740-08 ~]# virsh snapshot-create vm1
Domain snapshot 1641971554 created

[root@dell-per740-08 ~]# virsh snapshot-list vm1
 Name         Creation Time               State
---------------------------------------------------
 1641971554   2022-01-12 02:12:34 -0500   running

[root@dell-per740-08 ~]# qemu-img info /var/lib/libvirt/images/jeos-27-x86_64.qcow2 -U | grep 164
1         1641971554       7.88 MiB 2022-01-12 02:12:34 00:00:03.655      


3. prepare the snapshot xml to be redefined
[root@dell-per740-08 ~]# virsh snapshot-dumpxml vm1 1641971554 > vm1.snap

4. redefine the snapshot with --current     
[root@dell-per740-08 ~]# virsh snapshot-create vm1 --redefine vm1.snap --currentDomain snapshot 1641971554 created from 'vm1.snap'

5. the snapshot's metadata lost
[root@dell-per740-08 ~]# virsh snapshot-list vm1
 Name   Creation Time   State
-------------------------------
<=== nothing here
        
[root@dell-per740-08 ~]# virsh snapshot-delete vm1 1641971554
error: Failed to delete snapshot ��{L@
error: Domain snapshot not found: no domain snapshot with matching name '��{L@'

[root@dell-per740-08 ~]# qemu-img info /var/lib/libvirt/images/jeos-27-x86_64.qcow2 -U | grep 164
1         1641971554       7.88 MiB 2022-01-12 02:12:34 00:00:03.655   

Actual results:
snapshot's metadata lost

Expected results:
metadata should be kept

Comment 2 yisun 2022-01-12 10:15:32 UTC
metadata also lost when do snapshot-edit

[root@dell-per740-08 libvirt]# virsh start vm1
Domain 'vm1' started

[root@dell-per740-08 libvirt]# virsh snapshot-create-as vm1 s1
Domain snapshot s1 created
[root@dell-per740-08 libvirt]# virsh snapshot-list vm1
 Name   Creation Time               State
---------------------------------------------
 s1     2022-01-12 05:13:59 -0500   running

[root@dell-per740-08 libvirt]# virsh snapshot-edit vm1 s1 --rename
<=== change something such as rename from s1 to s2, and save it


[root@dell-per740-08 libvirt]# virsh snapshot-list vm1
 Name   Creation Time   State
-------------------------------

Comment 3 yisun 2022-01-12 10:28:05 UTC
And with some other steps with the vm with snapshot's metadata messed up, the virtqemud hit a crash issue. 

[root@dell-per740-08 libvirt]# virsh start vm1
Domain 'vm1' started

[root@dell-per740-08 libvirt]# virsh snapshot-create-as vm1 s1
Domain snapshot s1 created

[root@dell-per740-08 libvirt]# virsh snapshot-edit vm1 s1 --rename
error: unsupported configuration: Target domain virt type kvm does not match source (null)
Failed. Try again? [y,n,f,?]: 
error: Disconnected from qemu:///system due to end of file
error: Cannot recv data: Connection reset by peer
Failed. Try again? [y,n,f,?]: 



[root@dell-per740-08 ~]# coredumpctl debug
           PID: 519356 (virtqemud)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 11 (SEGV)
     Timestamp: Wed 2022-01-12 05:20:24 EST (2min 33s ago)
  Command Line: /usr/sbin/virtqemud --timeout 120
    Executable: /usr/sbin/virtqemud
 Control Group: /system.slice/virtqemud.service
          Unit: virtqemud.service
         Slice: system.slice
       Boot ID: 97eb0304752f41379a994f75a885577f
    Machine ID: f881cbfdc20e48f08a61d459a46b17bc
      Hostname: dell-per740-08.lab.eng.pek2.redhat.com
       Storage: /var/lib/systemd/coredump/core.virtqemud.0.97eb0304752f41379a994f75a885577f.519356.1641982824000000.zst (present)
     Disk Size: 1.4M
       Message: Process 519356 (virtqemud) of user 0 dumped core.
                
                Found module linux-vdso.so.1 with build-id: a0c01f084865528f7e26790cc6a070731c2e86fb
                Found module libvirt_storage_file_fs.so with build-id: a8ebe21c1aa65a9ee0f1b17d15ccbc1a98e39862
                Found module libnss_systemd.so.2 with build-id: db756d53576f89f80ff48f3638859c8ab2cb9e47
                Found module libnss_sss.so.2 with build-id: f056201210c4d387014791b6506a3ed3ce087e99
                Found module libvirt_driver_qemu.so with build-id: 1c2375f45936b48b8bd8199aba13b195404dde44
                Found module libbrotlicommon.so.1 with build-id: 4484908208e1f3ccfc9b4fb0a7dccdb8ba31e461
                Found module libkeyutils.so.1 with build-id: 83c6539bd0d3140678ba836b8baa1b215efa2632
                Found module libkrb5support.so.0 with build-id: 5069a64490aa2b5735d3cedab24a72999f333646
                Found module libblkid.so.1 with build-id: 25ffb35e40228ef3df3249c7f1d8cd6135cbcf08
                Found module libbrotlidec.so.1 with build-id: 753ad737d1a65860a1859053e42f74288043f9cc
                Found module liblber-2.4.so.2 with build-id: a23d9d858311a2cc0105fd7589ae6605a5d82417
                Found module libldap_r-2.4.so.2 with build-id: 7270d7cb5191c1d67aa72bbf30e5754c685f1569
                Found module libssl.so.3 with build-id: 4b7e62a82633f7baec133df0f8637529f199bb0b
                Found module libpsl.so.5 with build-id: a6b7ff002e3047642554bc414c2fca2f4c1c8f0d
                Found module libnghttp2.so.14 with build-id: 7eadbd56a0e5bcd3d8a6b39b9bab2327e380283a
                Found module libresolv.so.2 with build-id: eaebc6c6a15dcc8af04ea904eb33aeb5557fcafd
                Found module libcrypt.so.2 with build-id: 6ce4e5eb200e61d07398af52f8bcb316cf8466e0
                Found module libcrypto.so.3 with build-id: e3a618644eec4fb65c7cd059c42592a686191f72
                Found module libpcre2-8.so.0 with build-id: a5dafbac0243bdc2e3b5ab9a07d61d4b32f86927
                Found module libgmp.so.10 with build-id: 754b87178e725c166a68353f043ba7638e0723e1
                Found module libhogweed.so.6 with build-id: 21c32760f1f50b9d69b43e966b93fb3de8baa076
                Found module libnettle.so.8 with build-id: 3eda844d5a5df2443a281158b0d7ca6e81483b59
                Found module libtasn1.so.6 with build-id: 3d3a2f6f0d4a70919496afe25e329abd189b7882
                Found module libunistring.so.2 with build-id: 15e34cdfafa3547f9c700489b842ceb86f6fb73e
                Found module libidn2.so.0 with build-id: 958c50fc94ecb196b24f3619762e7ec3f28a5b40
                Found module libp11-kit.so.0 with build-id: b03163bf5b98313c7347e7270627a6b2dcd35060
                Found module libattr.so.1 with build-id: e67f1fc89e8ac6a35f6fda914bcf6144b9ccb99c
                Found module liblzma.so.5 with build-id: 66b7fca8b63a61d19c5ded440ee6a8bf05dcafa5
                Found module libcom_err.so.2 with build-id: deb039f83bae82e65be49dd97ac3d900a053e265
                Found module libk5crypto.so.3 with build-id: abb23c37a80a2cac360cfe37ec0fa449f7404bda
                Found module libkrb5.so.3 with build-id: e1269858fe001a22b237cf297e184dab73607e29
                Found module libgssapi_krb5.so.2 with build-id: bc201ea856d0b83d368bc5ddeb7c64f772b7d9bc
                Found module libmount.so.1 with build-id: 1077c04e3ad4a2c41847935efac0dedefe8dab78
                Found module libz.so.1 with build-id: 62196acf9f75625acb09840435bb396c62829e12
                Found module libgmodule-2.0.so.0 with build-id: 952459b04fb217bc3e4a17b902759cf66c89a95d
                Found module libffi.so.8 with build-id: 48e3675db4765a2e42729140922e11a10016f7ab
                Found module libpcre.so.1 with build-id: cffb947bcc416dca3cd249cdb0a1c6f614549c30
                Found module ld-linux-x86-64.so.2 with build-id: 2b7f1f415256e40ab15e5808c73eb7acf3c73ea3
                Found module libcurl.so.4 with build-id: 35e4925a0ee3773ff6ba41d190bed7de554dd3c9
                Found module libsasl2.so.3 with build-id: 2864d8e1600f3b46016fd62c44269e92c5ec0ca1
                Found module libssh.so.4 with build-id: b379b62a208293a838db07054df7f0bec4ab4de7
                Found module libyajl.so.2 with build-id: 7566fc033870a3570562a94020172bd833e2c351
                Found module libselinux.so.1 with build-id: c1d23d40bcf1fae271256fcbe90a46ff6dbcce20
                Found module libnuma.so.1 with build-id: 1b0da4895f73f3e94c76dcb2689ab086cb6a5d94
                Found module libnl-3.so.200 with build-id: 5690fe17968270ad4ee00fdafe15cf0a4db9c7ed
                Found module libm.so.6 with build-id: c58412f6a7fffa4068614708cdb5b15f2ba49c0a
                Found module libgnutls.so.30 with build-id: b08009ada925278615f5592e982e0776c06e065e
                Found module libcap-ng.so.0 with build-id: 47bbeb710b415ffc4f20f04b3c609445b9a7049d
                Found module libaudit.so.1 with build-id: a60491a2f8d3cf57e24254efd97fe954c4758116
                Found module libacl.so.1 with build-id: afd5611fa888ba30a62a2109d13bd3903d84c61c
                Found module libxml2.so.2 with build-id: 3e0fe83114ef422d225c047dd2f95a0d887dae96
                Found module libc.so.6 with build-id: 723a5d3072f3b79f3716880303439e11f7661fc5
                Found module libgcc_s.so.1 with build-id: a1a28a65f942690a11041922ba11c16f716565e2
                Found module libtirpc.so.3 with build-id: 18e30f3850200b01027da128e4ac79f305c14826
                Found module libgio-2.0.so.0 with build-id: 3150ddee37623cda47bb036458cddac38417037b
                Found module libgobject-2.0.so.0 with build-id: 1af07831c97e99858ee2b5383eb243f7ef1377ff
                Found module libglib-2.0.so.0 with build-id: 0006a4eed3e835c7d7812e36e5d720c1a6eb8689
                Found module libvirt-qemu.so.0 with build-id: 14533e7dae37a0fa6e3871b8dcb4a815d46e5cc3
                Found module libvirt-lxc.so.0 with build-id: 925f6cf3ccd900076892bc3380fc10cb165b5b3b
                Found module libvirt.so.0 with build-id: e7b63b255b9ede39e5dd9858b00389ac8f671101
                Found module virtqemud with build-id: a879fa2b5dbe8c0dbb573b4776a8018cfe2cf8ac
                Stack trace of thread 519357:
                #0  0x00007f2006ded75c __strlen_evex (libc.so.6 + 0x19775c)
                #1  0x00007f20072e0349 virBufferEscapeString (libvirt.so.0 + 0xbe349)
                #2  0x00007f20073b5bf3 virDomainDefFormatInternalSetRootName (libvirt.so.0 + 0x193bf3)
                #3  0x00007f20073b8dd5 virDomainDefFormat (libvirt.so.0 + 0x196dd5)
                #4  0x00007f20073a518c virDomainDefCheckABIStabilityFlags (libvirt.so.0 + 0x18318c)
                #5  0x00007f20073c8968 virDomainSnapshotRedefinePrep (libvirt.so.0 + 0x1a6968)
                #6  0x00007f2000d49dc4 qemuSnapshotCreateXML (libvirt_driver_qemu.so + 0x154dc4)
                #7  0x00007f2000cd3aa5 qemuDomainSnapshotCreateXML (libvirt_driver_qemu.so + 0xdeaa5)
                #8  0x00007f200752828d virDomainSnapshotCreateXML (libvirt.so.0 + 0x30628d)
                #9  0x0000562176c3afcc remoteDispatchDomainSnapshotCreateXMLHelper.lto_priv.0 (virtqemud + 0x45fcc)
                #10 0x00007f20074130f6 virNetServerProgramDispatch (libvirt.so.0 + 0x1f10f6)
                #11 0x00007f20074199d8 virNetServerHandleJob (libvirt.so.0 + 0x1f79d8)
                #12 0x00007f2007355323 virThreadPoolWorker (libvirt.so.0 + 0x133323)
                #13 0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #14 0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #15 0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519356:
                #0  0x00007f2006d5796f __GI___libc_write (libc.so.6 + 0x10196f)
                #1  0x00007f2007301e3b safewrite (libvirt.so.0 + 0xdfe3b)
                #2  0x00007f200731db66 virLogOutputToFd (libvirt.so.0 + 0xfbb66)
                #3  0x00007f200731dddc virLogMessage (libvirt.so.0 + 0xfbddc)
                #4  0x00007f2007301130 virEventGLibHandleUpdate (libvirt.so.0 + 0xdf130)
                #5  0x00007f2007407d75 virNetSocketUpdateIOCallback (libvirt.so.0 + 0x1e5d75)
                #6  0x00007f200741481b virNetServerClientUpdateEvent (libvirt.so.0 + 0x1f281b)
                #7  0x00007f2007415f4b virNetServerClientDispatchRead (libvirt.so.0 + 0x1f3f4b)
                #8  0x00007f20074163e7 virNetServerClientDispatchEvent (libvirt.so.0 + 0x1f43e7)
                #9  0x00007f20072f90d8 virEventGLibHandleDispatch (libvirt.so.0 + 0xd70d8)
                #10 0x00007f2007132f6f g_main_context_dispatch (libglib-2.0.so.0 + 0x54f6f)
                #11 0x00007f20071875d8 g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa95d8)
                #12 0x00007f20071306a3 g_main_context_iteration (libglib-2.0.so.0 + 0x526a3)
                #13 0x00007f20072f8764 virEventGLibRunOnce (libvirt.so.0 + 0xd6764)
                #14 0x00007f2007417a2d virNetDaemonRun (libvirt.so.0 + 0x1f5a2d)
                #15 0x0000562176c1d37c main (virtqemud + 0x2837c)
                #16 0x00007f2006c83560 __libc_start_call_main (libc.so.6 + 0x2d560)
                #17 0x00007f2006c8360c __libc_start_main_impl (libc.so.6 + 0x2d60c)
                #18 0x0000562176c1dd15 _start (virtqemud + 0x28d15)
                
                Stack trace of thread 519358:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519359:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519362:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553b0 virThreadPoolWorker (libvirt.so.0 + 0x1333b0)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519367:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519360:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519371:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519369:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519370:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519361:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519363:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553b0 virThreadPoolWorker (libvirt.so.0 + 0x1333b0)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519374:
                #0  0x00007f2006d5b87f __GI___poll (libc.so.6 + 0x10587f)
                #1  0x00007f200718756c g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa956c)
                #2  0x00007f2007132533 g_main_loop_run (libglib-2.0.so.0 + 0x54533)
                #3  0x00007f2006fbe4fa gdbus_shared_thread_func (libgio-2.0.so.0 + 0x1114fa)
                #4  0x00007f2007161622 g_thread_proxy (libglib-2.0.so.0 + 0x83622)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519364:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553b0 virThreadPoolWorker (libvirt.so.0 + 0x1333b0)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519373:
                #0  0x00007f2006d5b87f __GI___poll (libc.so.6 + 0x10587f)
                #1  0x00007f200718756c g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa956c)
                #2  0x00007f20071306a3 g_main_context_iteration (libglib-2.0.so.0 + 0x526a3)
                #3  0x00007f20071306f1 glib_worker_main (libglib-2.0.so.0 + 0x526f1)
                #4  0x00007f2007161622 g_thread_proxy (libglib-2.0.so.0 + 0x83622)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519365:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553b0 virThreadPoolWorker (libvirt.so.0 + 0x1333b0)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519368:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519366:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553b0 virThreadPoolWorker (libvirt.so.0 + 0x1333b0)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519556:
                #0  0x00007f2006ce070a __futex_abstimed_wait_common64 (libc.so.6 + 0x8a70a)
                #1  0x00007f2006ce2e80 __pthread_cond_wait_common (libc.so.6 + 0x8ce80)
                #2  0x00007f200734c49b virCondWait (libvirt.so.0 + 0x12a49b)
                #3  0x00007f20073553e3 virThreadPoolWorker (libvirt.so.0 + 0x1333e3)
                #4  0x00007f2007353e79 virThreadHelper (libvirt.so.0 + 0x131e79)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 520506:
                #0  0x00007f2006d5b87f __GI___poll (libc.so.6 + 0x10587f)
                #1  0x00007f200718756c g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa956c)
                #2  0x00007f2007132533 g_main_loop_run (libglib-2.0.so.0 + 0x54533)
                #3  0x00007f20072f772f virEventThreadWorker (libvirt.so.0 + 0xd572f)
                #4  0x00007f2007161622 g_thread_proxy (libglib-2.0.so.0 + 0x83622)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)
                
                Stack trace of thread 519403:
                #0  0x00007f2006d5b87f __GI___poll (libc.so.6 + 0x10587f)
                #1  0x00007f200718756c g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa956c)
                #2  0x00007f2007132533 g_main_loop_run (libglib-2.0.so.0 + 0x54533)
                #3  0x00007f20072f772f virEventThreadWorker (libvirt.so.0 + 0xd572f)
                #4  0x00007f2007161622 g_thread_proxy (libglib-2.0.so.0 + 0x83622)
                #5  0x00007f2006ce3aaf start_thread (libc.so.6 + 0x8daaf)
                #6  0x00007f2006d68740 __clone3 (libc.so.6 + 0x112740)

GNU gdb (GDB) Red Hat Enterprise Linux 10.2-9.el9
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/virtqemud...
Reading symbols from /usr/lib/debug/usr/sbin/virtqemud-8.0.0-0rc1.1.el9.x86_64.debug...
[New LWP 519357]
[New LWP 519356]
[New LWP 519358]
[New LWP 519359]
[New LWP 519362]
[New LWP 519367]
[New LWP 519360]
[New LWP 519371]
[New LWP 519369]
[New LWP 519370]
[New LWP 519361]
[New LWP 519363]
[New LWP 519374]
[New LWP 519364]
[New LWP 519373]
[New LWP 519365]
[New LWP 519368]
[New LWP 519366]
[New LWP 519556]
[New LWP 520506]
[New LWP 519403]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/virtqemud --timeout 120'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex.S:77
77		VPCMP	$0, (%rdi), %YMMZERO, %k0
[Current thread is 1 (Thread 0x7f20055ed640 (LWP 519357))]

Comment 4 Peter Krempa 2022-01-12 11:33:37 UTC
'snapshot-edit' does a redefine of a snapshot, so that's the same. Also the problem is a use-after-free so the crash is also expected for this kind of bug.

Comment 5 Peter Krempa 2022-01-13 08:35:05 UTC
Fixed upstream:

commit 59e0d130fed50a9833a32654171fc71d7337a6f2
Author: Peter Krempa <pkrempa>
Date:   Wed Jan 12 10:31:59 2022 +0100

    qemuSnapshotRedefine: Fix use of snapshot definition after free
    
    Commit f4aae9726df factored out the snapshot redefinition code into a
    separate function, but didn't account for the fact that the code is
    consuming the reference to the snapshot definition and by moving the
    code away the caller (qemuSnapshotCreateXML) now frees the definition
    which didn't happen before as we cleared the pointer.
    
    Fix it by increasing the reference locally. Later patches will refactor
    the code so that it's more obvious what's happening.
    
    Fixes: f4aae9726df
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2039651
    Signed-off-by: Peter Krempa <pkrempa>
    Reviewed-by: Ján Tomko <jtomko>

v8.0.0-rc2-5-g59e0d130fe

Comment 6 liang cong 2022-01-14 08:04:36 UTC
Preverify on:
libvirt: v8.0.0-rc2-11-g55a248d354
qemu-6.2.0-2.fc36.x86_64
qemu-kvm-6.2.0-2.fc36.x86_64

steps:
1. Prepare a running guest.
# virsh domstate vm2
running

2. create a snapshot
# virsh snapshot-create vm1
Domain snapshot 1642141524 created

# virsh snapshot-list vm1
 Name         Creation Time               State
---------------------------------------------------
 1642141524   2022-01-14 06:25:24 +0000   running

# qemu-img info /var/lib/libvirt/images/RHEL-8.6-x86_64-latest.qcow2 -U | grep 164
1         1642141524        582 MiB 2022-01-14 06:25:24 00:01:58.268

3. prepare the snapshot xml 
# virsh snapshot-dumpxml vm1 1642141524 > vm1.snap

4. redefine the snapshot with --current 
# virsh snapshot-create vm1 --redefine vm1.snap --current
Domain snapshot 1642141524 created from 'vm1.snap'

5. list the snapshot:
# virsh snapshot-list vm1
 Name         Creation Time               State
---------------------------------------------------
 1642141524   2022-01-14 06:25:24 +0000   running

6. delete the snapshot:
# virsh snapshot-delete vm1 1642141524
Domain snapshot 1642141524 deleted

# qemu-img info /var/lib/libvirt/images/RHEL-8.6-x86_64-latest.qcow2 -U | grep 164

7. create a snapshot
# virsh snapshot-create-as vm1 s1
Domain snapshot s1 created

# virsh snapshot-list vm1
 Name   Creation Time               State
---------------------------------------------
 s1     2022-01-14 06:39:48 +0000   running

8. edit snapshot with snapshot-edit, for instance rename snapshot name to s12
# virsh snapshot-edit vm1 s1 --rename

9. check snapshot list
# virsh snapshot-list vm1
 Name   Creation Time               State
---------------------------------------------
 s12    2022-01-14 06:39:48 +0000   running

10. test other snapshot create,revert,edit scenarios without core dump found.

Comment 9 liang cong 2022-01-25 08:45:10 UTC
Verified on libvirt-8.0.0-1.el9.x86_64

# rpm -q libvirt qemu-kvm
libvirt-8.0.0-1.el9.x86_64
qemu-kvm-6.2.0-4.el9.x86_64

# virsh start vm1
Domain 'vm1' started

# virsh snapshot-create-as vm1 s1 --disk-only
Domain snapshot s1 created

# virsh snapshot-dumpxml vm1 s1 > s1.xml


# virsh snapshot-create --redefine vm1 s1.xml
Domain snapshot s1 created from 's1.xml'

# virsh snapshot-delete --metadata vm1 s1
Domain snapshot s1 deleted

# virsh snapshot-create --redefine vm1 s1.xml
Domain snapshot s1 created from 's1.xml'

# virsh snapshot-create --redefine vm1 s1.xml --disk-only
Domain snapshot s1 created from 's1.xml'




# virsh snapshot-list vm1
 Name   Creation Time               State
---------------------------------------------------
 s1     2022-01-18 21:19:27 -0500   disk-snapshot
 s2     2022-01-18 21:19:46 -0500   disk-snapshot
 s3     2022-01-18 21:19:54 -0500   disk-snapshot


# virsh snapshot-dumpxml vm1 s2>s2.xml


1. # for i in s1 s2;do virsh snapshot-create-as vm1 $i --disk-only;done
Domain snapshot s1 created
Domain snapshot s2 created

# virsh snapshot-current vm1 --name
s2

2. # virsh snapshot-edit vm1 s1 --current --rename   (s1 -> ss)

# virsh snapshot-current vm1 --name 
ss

3. # virsh snapshot-edit vm1 s2 --current --clone
Snapshot s2 cloned to s4.

# virsh snapshot-current vm1 --name
s4

# virsh start vm1
Domain 'vm1' started

# virsh snapshot-create vm1
Domain snapshot 1643098364 created


# virsh snapshot-list vm1
 Name         Creation Time               State
---------------------------------------------------
 1643098364   2022-01-25 03:12:44 -0500   running


# virsh snapshot-dumpxml vm1 1643098364 > 1643098364.snap

# virsh destroy vm1
Domain 'vm1' destroyed

# virsh snapshot-create vm1
Domain snapshot 1643098461 created

# virsh snapshot-dumpxml vm1 1643098461 > 1643098461.snap

# virsh snapshot-create vm1 --redefine 1643098364.snap --current
Domain snapshot 1643098364 created from '1643098364.snap'

# virsh snapshot-list vm1
 Name         Creation Time               State
---------------------------------------------------
 1643098364   2022-01-25 03:12:44 -0500   running
 1643098461   2022-01-25 03:14:21 -0500   shutoff

Comment 11 errata-xmlrpc 2022-05-17 12:46:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: libvirt), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2390