Bug 531979

Summary: A segmentation fault occurs when event-test runs.
Product: [Community] Virtualization Tools Reporter: kak <f-kak>
Component: libvirtAssignee: Libvirt Maintainers <libvirt-maint>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: low    
Version: unspecifiedCC: berrange, crobinso, jtomko, xen-maint
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-18 08:22:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description kak 2009-10-30 04:22:44 UTC 
Description of problem:

I use libvirt on CentOS 5.3 + Xen(xen.gz-2.6.18-128.el5).
Runing event-test which is event sample program in source with local URI,
a segmentation fault occurs.

----------------------------------------
# ./examples/domain-events/events-c/.libs/event-test
myEventAddHandleFunc:221: Add handle 5 1 0x2b6efa940f10 0xe85f1f0
myEventAddHandleFunc:221: Add handle 7 1 0x2b6efa941da0 0xe85f1f0
myEventAddHandleFunc:221: Add handle 8 1 0x2b6efa917bc0 0xe85f1f0
myEventAddTimeoutFunc:251: Adding Timeout -1 0x2b6efa91e980 0xe85f1f0
myEventAddHandleFunc:221: Add handle 11 1 0x2b6efa917bc0 0xe85f1f0
myEventAddTimeoutFunc:251: Adding Timeout -1 0x2b6efa91e980 0xe85f1f0
main:322 :: Registering domain event cbs
Segmentation fault
# ./examples/domain-events/events-c/.libs/event-test xen:///
myEventAddHandleFunc:221: Add handle 5 1 0x2b22ada80f10 0x840a1f0
myEventAddHandleFunc:221: Add handle 7 1 0x2b22ada81da0 0x840a1f0
myEventAddHandleFunc:221: Add handle 8 1 0x2b22ada57bc0 0x840a1f0
myEventAddTimeoutFunc:251: Adding Timeout -1 0x2b22ada5e980 0x840a1f0
myEventAddHandleFunc:221: Add handle 11 1 0x2b22ada57bc0 0x840a1f0
myEventAddTimeoutFunc:251: Adding Timeout -1 0x2b22ada5e980 0x840a1f0
main:322 :: Registering domain event cbs
Segmentation fault
#
----------------------------------------

But it doesn't occur with remote URI.

----------------------------------------
# ./examples/domain-events/events-c/.libs/event-test xen+ssh://localhost
root@localhost's password:
myEventAddHandleFunc:221: Add handle 3 1 0x2aad30a7bbc0 0x1a911f0
myEventAddTimeoutFunc:251: Adding Timeout -1 0x2aad30a82980 0x1a911f0
main:322 :: Registering domain event cbs
myEventUpdateHandleFunc:232: Updated Handle 0 0
myEventUpdateHandleFunc:232: Updated Handle 0 1
myDomainEventCallback1 EVENT: Domain rh5u2-fv(5) Started Booted
myDomainEventCallback2 EVENT: Domain rh5u2-fv(5) Started Booted
myDomainEventCallback1 EVENT: Domain rh5u2-fv(-1) Stopped Shutdown
myDomainEventCallback2 EVENT: Domain rh5u2-fv(-1) Stopped Shutdown
Exiting on signal 2
main:347 :: Poll failed
main:364 :: Deregistering event handlers
myFreeFunc: Freeing [callback 1]
myFreeFunc: Freeing [callback 2]
myEventUpdateHandleFunc:232: Updated Handle 0 0
libvir: Remote error : cannot recv data: Connection reset by peer
myEventUpdateHandleFunc:232: Updated Handle 0 1
main:370 :: Closing connection
myEventUpdateHandleFunc:232: Updated Handle 0 0
#
----------------------------------------

Version-Release number of selected component (if applicable):

The libvirt source did pull from git on 2009-10-30.

How reproducible:
Steps to Reproduce:

Runing event-test sample.

Actual results:

A segmentation fault occurs.

Expected results:

Runing on no segmentation fault.

Additional info:

----------------------------------------
# gdb ./examples/domain-events/events-c/.libs/event-test core.12437
GNU gdb Fedora (6.8-27.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
Reading symbols from /euca0/develop/libvirt/libvirt.git/src/.libs/libvirt.so...done.
Loaded symbols for /euca0/develop/libvirt/libvirt.git/src/.libs/libvirt.so
Reading symbols from /usr/lib64/libxml2.so.2...done.
Loaded symbols for /usr/lib64/libxml2.so.2
Reading symbols from /usr/lib64/libz.so.1...done.
Loaded symbols for /usr/lib64/libz.so.1
Reading symbols from /lib64/libm.so.6...done.
Loaded symbols for /lib64/libm.so.6
Reading symbols from /usr/lib64/libgnutls.so.13...done.
Loaded symbols for /usr/lib64/libgnutls.so.13
Reading symbols from /usr/lib64/libsasl2.so.2...done.
Loaded symbols for /usr/lib64/libsasl2.so.2
Reading symbols from /usr/lib64/libxenstore.so.3.0...done.
Loaded symbols for /usr/lib64/libxenstore.so.3.0
Reading symbols from /lib64/libpthread.so.0...done.
Loaded symbols for /lib64/libpthread.so.0
Reading symbols from /lib64/libc.so.6...done.
Loaded symbols for /lib64/libc.so.6
Reading symbols from /lib64/libdl.so.2...done.
Loaded symbols for /lib64/libdl.so.2
Reading symbols from /usr/lib64/libgcrypt.so.11...done.
Loaded symbols for /usr/lib64/libgcrypt.so.11
Reading symbols from /usr/lib64/libgpg-error.so.0...done.
Loaded symbols for /usr/lib64/libgpg-error.so.0
Reading symbols from /lib64/libresolv.so.2...done.
Loaded symbols for /lib64/libresolv.so.2
Reading symbols from /lib64/libcrypt.so.1...done.
Loaded symbols for /lib64/libcrypt.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /lib64/libnsl.so.1...done.
Loaded symbols for /lib64/libnsl.so.1
Core was generated by `./examples/domain-events/events-c/.libs/event-test xen:///'.
Program terminated with signal 11, Segmentation fault.
[New process 12437]
[New process 12439]
#0  remoteDomainEventQueueFlush (timer=<value optimized out>, opaque=0x1f2f11f0)
    at remote/remote_driver.c:8253
8253        tempQueue.count = priv->domainEvents->count;
(gdb) p tempQueue
$1 = {count = 479338944, events = 0x3be04ca448}
(gdb) p priv->domainEvents
$2 = (virDomainEventQueuePtr) 0x0
(gdb) l 8245
8240
8241    void
8242    remoteDomainEventQueueFlush(int timer ATTRIBUTE_UNUSED, void *opaque)
8243    {
8244        virConnectPtr conn = opaque;
8245        struct private_data *priv = conn->privateData;
8246        virDomainEventQueue tempQueue;
8247
8248        remoteDriverLock(priv);
8249
(gdb)
8250        priv->domainEventDispatching = 1;
8251
8252        /* Copy the queue, so we're reentrant safe */
8253        tempQueue.count = priv->domainEvents->count;
8254        tempQueue.events = priv->domainEvents->events;
8255        priv->domainEvents->count = 0;
8256        priv->domainEvents->events = NULL;
8257
8258        virDomainEventQueueDispatch(&tempQueue, priv->callbackList,
8259                                    remoteDomainEventDispatchFunc, priv);
(gdb) quit
#
----------------------------------------

I think that the pointer variable priv in remoteDomainEventQueueFlush()
should have conn->networkPrivateData.

The following patch may work fine:
----------------------------------------
# diff -u src/remote/remote_driver.c.orig src/remote/remote_driver.c
--- src/remote/remote_driver.c.orig     2009-10-23 09:35:48.000000000 +0900
+++ src/remote/remote_driver.c  2009-10-30 12:23:23.000000000 +0900
@@ -8242,7 +8242,7 @@
 remoteDomainEventQueueFlush(int timer ATTRIBUTE_UNUSED, void *opaque)
 {
     virConnectPtr conn = opaque;
-    struct private_data *priv = conn->privateData;
+    struct private_data *priv = conn->networkPrivateData;
     virDomainEventQueue tempQueue;

     remoteDriverLock(priv);
#
----------------------------------------

Thanks,
fumihiko kakuma
Comment 1 kak 2009-11-05 00:36:18 UTC 
I think that libvirt causes this trouble.
Would I be able to send the above-described patch to the libvir-list ML?
Comment 2 Ján Tomko 2015-03-18 08:22:23 UTC 
The event-test has been completely rewritten since:
commit 0c97e70b74434b4baca9bbfc19c14bf7ff2ef304
Author:     Daniel P. Berrange <berrange>
AuthorDate: 2011-03-23 14:30:30 +0000
Commit:     Daniel P. Berrange <berrange>
CommitDate: 2011-03-29 10:59:46 +0100

    Update event loop example programs to demonstrate best practice
    
    The example C event loop code is a nasty hack and not compliant
    with the require API semantics. Delete this, so that developers
    don't mistakenly copy it. Instead call the new public event loop
    APIs.
    
    Update the python event loop example, so that it can optionally
    use the public event APIs, as an alternative to the pure python
    code. The pure python event code is a good working example, so
    don't delete it.
    
    Also make the python example use a read only connection to avoid
    authentication prompts
    
    * examples/domain-events/events-c/event-test.c: Replace event
      loop code with use of public APIs
    * examples/domain-events/events-python/event-test.py: Allow
      optional use of new public event APIs

git describe: v0.8.8-286-g0c97e70 contains: v0.9.0~49