Bug 677484

Summary: virDomainMemoryStats can crash client
Product: Red Hat Enterprise Linux 6 Reporter: Eric Blake <eblake>
Component: libvirtAssignee: Eric Blake <eblake>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.1CC: eblake, llim, mzhan, vbian, veillard, xen-maint, yoyzhang
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libvirt-0.8.7-7.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 13:27:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Eric Blake 2011-02-14 23:35:57 UTC
Description of problem:
Most libvirt APIs do argument validation, and properly report an error if a NULL object was passed in.  However, virDomainMemoryStats causes a segfault.

Version-Release number of selected component (if applicable):
libvirt-0.8.7-5.el6

How reproducible:
100%

Steps to Reproduce:
1. $ cat foo.c
#include <libvirt.h>
#include <stdlib.h>
int main ()
{
  if (virNWFilterGetXMLDesc(NULL, 1))
    return 1;
  if (virDomainMemoryStats(NULL, NULL, 0, 1) == -1)
    return 0;
  return 2;
}
2. $ gcc -I/usr/include/libvirt -o foo -Wall foo.c -lvirt
3. $ ./foo; echo $?
  
Actual results:
libvir: error : Unknown failure
Segmentation fault (core dumped)
139


Expected results:
libvir: error : Unknown failure
libvir: error : Unknown failure
0

Additional info:
The first call to virNWFilterGetXMLDesc is a sample API that proves that libvirt does argument validation and properly recognizes a NULL pointer.  The second call to virDomainMemoryStats should do likewise, but it mistakenly reports an error about invalid flags before validating the domain pointer, and ends up dereferencing NULL.

Fixed by this upstream patch:
https://www.redhat.com/archives/libvir-list/2011-February/msg00479.html

Comment 4 Vivian Bian 2011-02-21 09:41:55 UTC
Verified with libvirt-0.8.7-7.el6.x86_64

[reproducer with libvirt-0.8.7-5.el6]
1. $ cat foo.c
#include <libvirt.h>
#include <stdlib.h>
int main ()
{
  if (virNWFilterGetXMLDesc(NULL, 1))
    return 1;
  if (virDomainMemoryStats(NULL, NULL, 0, 1) == -1)
    return 0;
  return 2;
}
2. $ gcc -I/usr/include/libvirt -o foo -Wall foo.c -lvirt
3. $ ./foo; echo $?

libvir: error : Unknown failure
Segmentation fault (core dumped)
139

[verification result with libvirt-0.8.7-7.el6.x86_64]

1. $ cat foo.c
#include <libvirt.h>
#include <stdlib.h>
int main ()
{
  if (virNWFilterGetXMLDesc(NULL, 1))
    return 1;
  if (virDomainMemoryStats(NULL, NULL, 0, 1) == -1)
    return 0;
  return 2;
}
2. $ gcc -I/usr/include/libvirt -o foo -Wall foo.c -lvirt
3. $ ./foo; echo $?

libvir: error : Unknown failure
libvir: error : Unknown failure
0


we get the expected result , so set bug status to VERIFIED

Comment 5 Min Zhan 2011-04-18 07:16:33 UTC
Verified with Passed with below environment:
libvirt-0.8.7-17.el6
qemu-kvm-0.12.1.2-2.158.el6.x86_64
# uname -a
Linux localhost.localdomain 2.6.32-131.0.1.el6.x86_64 #1 SMP Tue Apr 12
16:40:23 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

Comment 8 errata-xmlrpc 2011-05-19 13:27:25 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0596.html