Bug 2266017
| Summary: | virtinterfaced SIGABRT in xdr_remote_interface_lookup_by_mac_string_args() due to memory corruption | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Pitt <mpitt> |
| Component: | libvirt | Assignee: | Libvirt Maintainers <libvirt-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 39 | CC: | berrange, clalancette, crobinso, jforbes, jiyin, laine, libvirt-maint, mvollmer, virt-maint |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| URL: | https://cockpit-logs.us-east-1.linodeobjects.com/pull-5903-20240212-230634-e54961ef-fedora-39-firefox-cockpit-project-cockpit-machines/log.html#60 | ||
| Whiteboard: | CockpitTest | ||
| Fixed In Version: | libvirt-10.1.0-2.fc40 libvirt-9.7.0-4.fc39 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-06-11 01:49:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Martin Pitt
2024-02-26 10:16:15 UTC
Yesterday's test run in https://cockpit-logs.us-east-1.linodeobjects.com/pull-6166-a97c224f-20240403-154431-fedora-40-cockpit-project-cockpit-machines/log.html#70 has shown another variant: #0 0x00007fcd502b2144 __pthread_kill_implementation (libc.so.6 + 0x98144) #1 0x00007fcd5025a65e raise (libc.so.6 + 0x4065e) #2 0x00007fcd50242902 abort (libc.so.6 + 0x28902) #3 0x00007fcd4ec5f901 log_assert_failed.cold (libudev.so.1 + 0x6901) #4 0x00007fcd4ec6921f udev_ref (libudev.so.1 + 0x1021f) #5 0x00007fcd4ec958d5 udevInterfaceGetXMLDesc (libvirt_driver_interface.so + 0x48d5) #6 0x00007fcd50942d75 virInterfaceGetXMLDesc (libvirt.so.0 + 0x342d75) #7 0x000055ef3de5a106 remoteDispatchInterfaceGetXMLDescHelper.lto_priv.0 (virtinterfaced + 0x66106) #8 0x00007fcd50806e29 virNetServerProgramDispatch (libvirt.so.0 + 0x206e29) #9 0x00007fcd5080d8a3 virNetServerProcessMsg (libvirt.so.0 + 0x20d8a3) #10 0x00007fcd5080d9b6 virNetServerHandleJob (libvirt.so.0 + 0x20d9b6) #11 0x00007fcd507456f5 virThreadPoolWorker (libvirt.so.0 + 0x1456f5) #12 0x00007fcd507448cd virThreadHelper (libvirt.so.0 + 0x1448cd) #13 0x00007fcd502b01b7 start_thread (libc.so.6 + 0x961b7) #14 0x00007fcd5033239c __clone3 (libc.so.6 + 0x11839c) bug 2266014 is already fixed/closed, and was about udevInterfaceLookupByMACString(). But this looks too close to be a coincidence, so for now I won't file another bug. If you want me to, I can though. A recent F40 run in https://cockpit-logs.us-east-1.linodeobjects.com/pull-1643-7d20b02f-20240519-191431-fedora-40-devel/log.html#83 has the same remoteDispatchInterfaceGetXMLDescHelper -> virInterfaceGetXMLDesc crash. > [1] https://github.com/cockpit-project/cockpit-machines/issues/1391#issuecomment-1963676507 That shows: virtinterfaced[1858]: Assertion '*q > 0' failed at src/libudev/libudev.c:91, function udev_ref(). Aborting. which is the missing context I wanted from the stack trace in comment #1 and comment #2. IOW, we have a refcount underflow - it can't have wrapped since there's another assert_se call that should log a message on overflow. I can spot one bug in virInterfaceGetXMLDesc(), where it could fail to release a reference if an invalid flag is passed in, but that should be resulting in clear errors in your app code, and would result in an overflow eventually, not an underflow. FEDORA-2024-ee96e0c470 (libvirt-10.1.0-2.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-ee96e0c470 FEDORA-2024-c2e7b82022 (libvirt-9.7.0-4.fc39) has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2e7b82022 > I can spot one bug in virInterfaceGetXMLDesc(), where it could fail to release a reference if an invalid flag is passed in, but that should be resulting in clear errors in your app code, and would result in an overflow eventually, not an underflow.
The update I've issued addresses that flaw. I'm fairly sceptical that it will solve the problem cockpit sees, but its worth a try as thus far I can't explain the problem otherwise.
FEDORA-2024-ee96e0c470 has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-ee96e0c470` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ee96e0c470 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-c2e7b82022 has been pushed to the Fedora 39 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c2e7b82022` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2e7b82022 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-ee96e0c470 (libvirt-10.1.0-2.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2024-c2e7b82022 (libvirt-9.7.0-4.fc39) has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report. Our CI bots believe the issue has been fixed: https://github.com/cockpit-project/bots/pull/6953 They didn't see any core dumps of virtinterfaced for 25 days. Thanks! cockpit-machines also stopped using virtinterfaced: https://github.com/cockpit-project/cockpit-machines/pull/1782 |