Bug 741533
Summary: | Malformed command on SPICE connect/disconnect causes libvirt crash | ||||||
---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | Daniel Paikov <dpaikov> | ||||
Component: | libvirt | Assignee: | Peter Krempa <pkrempa> | ||||
Status: | CLOSED DUPLICATE | QA Contact: | Virtualization Bugs <virt-bugs> | ||||
Severity: | high | Docs Contact: | |||||
Priority: | high | ||||||
Version: | 6.1 | CC: | acathrow, dallan, hateya, jlibosva, mzhan, rwu, vbian, veillard, weizhan, yafu, zpeng | ||||
Target Milestone: | rc | ||||||
Target Release: | --- | ||||||
Hardware: | Unspecified | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2011-10-03 13:55:29 UTC | Type: | --- | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Bug Depends On: | |||||||
Bug Blocks: | 730297 | ||||||
Attachments: |
|
Description
Daniel Paikov
2011-09-27 08:16:06 UTC
Created attachment 525048 [details]
libvirtd.log
We need a reproducer, how did you end up with the malformed commands and what are the steps to reproduce the issue. The crash is in malloc() i.e. the problem was earlier something before corrupted the memory allocator data so we need to reproduce this and can't debug it just from the stack trace. Also in case of crash the libvirtd.log should contain the full debug buffer as saved by the signal error handler and that's not part of the file you provided, so please provide the actual libvirtd.log from the crashed libvirt daemon, thanks, Daniel It would be helpful, if you could provide: - versions of other relevant packages (qemu ...) - configuration file of the domain that caused the problem. - optional: valgrind run on libvirtd while reproducing the bug It would help reproducing the bug. Thanks Peter These are the versions I'm using: libvirt-0.9.4-12.el6.x86_64 qemu-kvm-0.12.1.2-2.192.el6.x86_64 vdsm-4.9-104.el6.x86_64 Steps to reproduce: This crash happened during my attempt to verify bug #730297 - opening two SPICE sessions to the same VM. While the first SPICE session is running, opening the 2nd SPICE session produces this crash. This can be done either by opening both the admin portal and the user portal on the same client machine, or by opening two user portal sessions on two client machines. As for the other questions, please contact me on IRC (dpaikov). This is my first libvirt bug and I'm not familiar with all the terminology. ==10822== Thread 1: ==10822== Invalid free() / delete / delete[] ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x50792B8: virFree (memory.c:310) ==10822== by 0x50ADC49: virDomainEventFree (domain_event.c:489) ==10822== by 0x50ADF42: virDomainEventQueueDispatch (domain_event.c:1154) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== by 0x506FDA5: virEventPollRunOnce (event_poll.c:421) ==10822== by 0x506EED6: virEventRunDefaultImpl (event.c:247) ==10822== by 0x43F97C: virNetServerRun (virnetserver.c:701) ==10822== by 0x41ED03: main (libvirtd.c:1591) ==10822== Address 0x1aa48a80 is 0 bytes inside a block of size 13 free'd ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x6D90967: xdr_string (in /lib64/libc-2.12.so) ==10822== by 0x43898D: xdr_remote_nonnull_string (remote_protocol.c:30) ==10822== by 0x438C5B: xdr_remote_domain_event_graphics_address (remote_protocol.c:3907) ==10822== by 0x43C37B: xdr_remote_domain_event_graphics_msg (remote_protocol.c:3934) ==10822== by 0x6D90114: xdr_free (in /lib64/libc-2.12.so) ==10822== by 0x4344E8: remoteRelayDomainEventGraphics (remote.c:333) ==10822== by 0x50AE0DA: virDomainEventDispatchDefaultFunc (domain_event.c:1064) ==10822== by 0x477907: qemuDomainEventDispatchFunc (qemu_domain.c:125) ==10822== by 0x50ADECA: virDomainEventDispatch (domain_event.c:1136) ==10822== by 0x50ADF31: virDomainEventQueueDispatch (domain_event.c:1153) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== ==10822== Invalid free() / delete / delete[] ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x50792B8: virFree (memory.c:310) ==10822== by 0x50ADC5B: virDomainEventFree (domain_event.c:490) ==10822== by 0x50ADF42: virDomainEventQueueDispatch (domain_event.c:1154) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== by 0x506FDA5: virEventPollRunOnce (event_poll.c:421) ==10822== by 0x506EED6: virEventRunDefaultImpl (event.c:247) ==10822== by 0x43F97C: virNetServerRun (virnetserver.c:701) ==10822== by 0x41ED03: main (libvirtd.c:1591) ==10822== Address 0x1aa41840 is 0 bytes inside a block of size 1 free'd ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x6D90967: xdr_string (in /lib64/libc-2.12.so) ==10822== by 0x43898D: xdr_remote_nonnull_string (remote_protocol.c:30) ==10822== by 0x438C6B: xdr_remote_domain_event_graphics_address (remote_protocol.c:3909) ==10822== by 0x43C37B: xdr_remote_domain_event_graphics_msg (remote_protocol.c:3934) ==10822== by 0x6D90114: xdr_free (in /lib64/libc-2.12.so) ==10822== by 0x4344E8: remoteRelayDomainEventGraphics (remote.c:333) ==10822== by 0x50AE0DA: virDomainEventDispatchDefaultFunc (domain_event.c:1064) ==10822== by 0x477907: qemuDomainEventDispatchFunc (qemu_domain.c:125) ==10822== by 0x50ADECA: virDomainEventDispatch (domain_event.c:1136) ==10822== by 0x50ADF31: virDomainEventQueueDispatch (domain_event.c:1153) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== ==10822== Invalid free() / delete / delete[] ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x50792B8: virFree (memory.c:310) ==10822== by 0x50ADC80: virDomainEventFree (domain_event.c:494) ==10822== by 0x50ADF42: virDomainEventQueueDispatch (domain_event.c:1154) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== by 0x506FDA5: virEventPollRunOnce (event_poll.c:421) ==10822== by 0x506EED6: virEventRunDefaultImpl (event.c:247) ==10822== by 0x43F97C: virNetServerRun (virnetserver.c:701) ==10822== by 0x41ED03: main (libvirtd.c:1591) ==10822== Address 0x1a613fe0 is 0 bytes inside a block of size 13 free'd ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x6D90967: xdr_string (in /lib64/libc-2.12.so) ==10822== by 0x43898D: xdr_remote_nonnull_string (remote_protocol.c:30) ==10822== by 0x438C5B: xdr_remote_domain_event_graphics_address (remote_protocol.c:3907) ==10822== by 0x43C38B: xdr_remote_domain_event_graphics_msg (remote_protocol.c:3936) ==10822== by 0x6D90114: xdr_free (in /lib64/libc-2.12.so) ==10822== by 0x4344E8: remoteRelayDomainEventGraphics (remote.c:333) ==10822== by 0x50AE0DA: virDomainEventDispatchDefaultFunc (domain_event.c:1064) ==10822== by 0x477907: qemuDomainEventDispatchFunc (qemu_domain.c:125) ==10822== by 0x50ADECA: virDomainEventDispatch (domain_event.c:1136) ==10822== by 0x50ADF31: virDomainEventQueueDispatch (domain_event.c:1153) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== ==10822== Invalid free() / delete / delete[] ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x50792B8: virFree (memory.c:310) ==10822== by 0x50ADC92: virDomainEventFree (domain_event.c:495) ==10822== by 0x50ADF42: virDomainEventQueueDispatch (domain_event.c:1154) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== by 0x506FDA5: virEventPollRunOnce (event_poll.c:421) ==10822== by 0x506EED6: virEventRunDefaultImpl (event.c:247) ==10822== by 0x43F97C: virNetServerRun (virnetserver.c:701) ==10822== by 0x41ED03: main (libvirtd.c:1591) ==10822== Address 0x1a613220 is 0 bytes inside a block of size 1 free'd ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x6D90967: xdr_string (in /lib64/libc-2.12.so) ==10822== by 0x43898D: xdr_remote_nonnull_string (remote_protocol.c:30) ==10822== by 0x438C6B: xdr_remote_domain_event_graphics_address (remote_protocol.c:3909) ==10822== by 0x43C38B: xdr_remote_domain_event_graphics_msg (remote_protocol.c:3936) ==10822== by 0x6D90114: xdr_free (in /lib64/libc-2.12.so) ==10822== by 0x4344E8: remoteRelayDomainEventGraphics (remote.c:333) ==10822== by 0x50AE0DA: virDomainEventDispatchDefaultFunc (domain_event.c:1064) ==10822== by 0x477907: qemuDomainEventDispatchFunc (qemu_domain.c:125) ==10822== by 0x50ADECA: virDomainEventDispatch (domain_event.c:1136) ==10822== by 0x50ADF31: virDomainEventQueueDispatch (domain_event.c:1153) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== ==10822== Invalid free() / delete / delete[] ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x50792B8: virFree (memory.c:310) ==10822== by 0x50ADCAE: virDomainEventFree (domain_event.c:498) ==10822== by 0x50ADF42: virDomainEventQueueDispatch (domain_event.c:1154) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== by 0x506FDA5: virEventPollRunOnce (event_poll.c:421) ==10822== by 0x506EED6: virEventRunDefaultImpl (event.c:247) ==10822== by 0x43F97C: virNetServerRun (virnetserver.c:701) ==10822== by 0x41ED03: main (libvirtd.c:1591) ==10822== Address 0x1a6175d0 is 0 bytes inside a block of size 6 free'd ==10822== at 0x4C2695D: free (vg_replace_malloc.c:366) ==10822== by 0x6D90967: xdr_string (in /lib64/libc-2.12.so) ==10822== by 0x43898D: xdr_remote_nonnull_string (remote_protocol.c:30) ==10822== by 0x43C39B: xdr_remote_domain_event_graphics_msg (remote_protocol.c:3938) ==10822== by 0x6D90114: xdr_free (in /lib64/libc-2.12.so) ==10822== by 0x4344E8: remoteRelayDomainEventGraphics (remote.c:333) ==10822== by 0x50AE0DA: virDomainEventDispatchDefaultFunc (domain_event.c:1064) ==10822== by 0x477907: qemuDomainEventDispatchFunc (qemu_domain.c:125) ==10822== by 0x50ADECA: virDomainEventDispatch (domain_event.c:1136) ==10822== by 0x50ADF31: virDomainEventQueueDispatch (domain_event.c:1153) ==10822== by 0x50AF13D: virDomainEventStateFlush (domain_event.c:1195) ==10822== by 0x4778B1: qemuDomainEventFlush (qemu_domain.c:134) ==10822== *** This bug has been marked as a duplicate of bug 737881 *** |