Bug 523418

Summary: xmldesc with a typo makes libvirtd sefault
Product: Red Hat Enterprise Linux 5 Reporter: Dan Kenigsberg <danken>
Component: libvirtAssignee: Daniel Veillard <veillard>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: medium    
Version: 5.4CC: gren, virt-maint, xen-maint, yoyzhang
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-30 08:09:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
trivial backport to RHEL-5.4 of upstream patch none

Description Dan Kenigsberg 2009-09-15 12:23:08 UTC
Description of problem:
I've used createLinux with the following section in xmldesc
    <interface type='bridge'>
       <target def='vnet8'/>
    </interface>
note that "def" instead of "dev". It's ok for libvirt not to like it, but it should not die.

Version-Release number of selected component (if applicable):
libvirt-0.6.3-20.1.el5_4

How reproducible:
always

Steps to Reproduce:
conn.createLinux(xmldesc, 0)
with xmldesc=

  <domain type='kvm'>
  <name>segfault</name>
  <uuid>9ffe28b6-6134-4b1e-8804-1185f49c436f</uuid>
  <memory>256</memory>
  <currentMemory>256</currentMemory>
  <os>
    <type arch='i686' machine='pc'>hvm</type>
    <boot dev='hd'/>
  </os>
  <devices>
    <interface type='bridge'>
       <target def='vnet8'/>
    </interface>
    <serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target port='0'/>
    </console>
    <input type='mouse' bus='ps2'/>
    <graphics type='vnc' port='5910' autoport='no' listen='0'/>
  </devices>
</domain>

Actual results:
libvirtd dead

Expected results:
error code returned

Additional info:

Comment 1 Daniel Veillard 2009-09-30 16:47:15 UTC
Fix is trivial, posted it upstream, I expect to have this fixed there
real soon:

https://www.redhat.com/archives/libvir-list/2009-September/msg00931.html

Not sure if it's worth a Z-Stream errata, but we should definitely fix this
for 5.5 at least,

Daniel

Comment 2 Dan Kenigsberg 2009-09-30 17:09:55 UTC
wow, I'm so lucky to have stepped on the only place where virXMLPropString()'s return value was not tested.

Comment 3 Daniel Veillard 2009-10-01 10:11:39 UTC
Well fix is upstream now, I will try to push the fix on the RHEL-5 branch
but no hurry if we don't do a an errata for it.

Daniel

Comment 4 Daniel Veillard 2009-11-18 17:18:57 UTC
Created attachment 370139 [details]
trivial backport to RHEL-5.4 of upstream patch

Comment 5 Daniel Veillard 2009-11-25 16:10:22 UTC
libvirt-0.6.3-22.el5 has been built in dist-5E-qu-candidate with
the fixes,

Daniel

Comment 7 Gunannan Ren 2009-12-31 06:01:45 UTC
The bugs has been fixed in libvirt-0.6.3-28.el5

I tried the bug on libvirt-0.6.3-20.el5 using "virsh define segfault.xml" XMLdesc like above xml definition. Libvirt reports error:
error:Faied to define domain from segfault.xml
error:server closed connection

and at the same time, the libvirtd died. 
the output of "service libvirtd status" is libvirtd dead but pid file exists

on libvirt-0.6.3-28.el5
error: Failed to define domain from segfault.xml
error: internal error No <source> 'dev' attribute specified with <interface type='bridge'/>

the libvirt daemon is running.

Comment 12 errata-xmlrpc 2010-03-30 08:09:57 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2010-0205.html