Bug 808371
| Summary: | libvirtd crashed with SIGSEGV in __strcmp_ssse3() | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Alex Jia <ajia> |
| Component: | libvirt | Assignee: | Alex Jia <ajia> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.3 | CC: | acathrow, dyasny, dyuan, mzhan, rwu, veillard, whuang |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-0.9.10-10.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-06-20 06:51:23 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Patch for upstream: https://www.redhat.com/archives/libvir-list/2012-March/msg01324.html (In reply to comment #0) > Version-Release number of selected component (if applicable): > # rpm -q libvirt > libvirt-0.9.10-6.el6.x86_64 It exists the same issue on libvirt-0.9.10-9.el6.x86_64. Upstream commit 814fcb9e08fdc80ff2d74d5ca205b9c8bd0d351c Daniel Verify this bug :
libvirt-0.9.10-10.el6.x86_64
qemu-kvm-0.12.1.2-2.267.el6.x86_64
Steps:
# qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 10M
Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=10485760
encryption=off cluster_size=65536
# cat > /tmp/test.xml <<EOF
<domain type='qemu'>
<name>test</name>
<memory>219200</memory>
<vcpu>1</vcpu>
<os>
<type arch='x86_64'>hvm</type>
<boot dev='hd'/>
</os>
<devices>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/var/lib/libvirt/images/test.img'/>
<target dev='vda' bus='virtio'/>
</disk>
<channel type='pty'>
<target type='virtio'/>
</channel>
<input type='mouse' bus='ps2'/>
<graphics type='spice' autoport='yes' listen='0.0.0.0'/>
</devices>
</domain>
EOF
# virsh define /tmp/test.xml
Domain test defined from /tmp/test.xml
# virsh snapshot-list test
Name Creation Time State
------------------------------------------------------------
# virsh snapshot-create-as test hello
Domain snapshot hello created
# virsh snapshot-list test
Name Creation Time State
------------------------------------------------------------
hello 2012-03-30 17:30:13 +0800 shutoff
# virsh snapshot-current test hello
Snapshot hello set as current
# /etc/init.d/libvirtd status
libvirtd (pid 26619) is running...
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2012-0748.html |
Description of problem: virsh edit a channel without target name into guest XML configuration then create a snapshot for the shut off status guest, finally, to use virsh snapshot-current to set current snapshot name, libvirt will crash due to derefing a NULL pointer. Version-Release number of selected component (if applicable): # rpm -q libvirt libvirt-0.9.10-6.el6.x86_64 How reproducible: always Steps to Reproduce: # qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 10M Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=10485760 encryption=off cluster_size=65536 # cat > /tmp/test.xml <<EOF <domain type='qemu'> <name>test</name> <memory>219200</memory> <vcpu>1</vcpu> <os> <type arch='x86_64'>hvm</type> <boot dev='hd'/> </os> <devices> <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/test.img'/> <target dev='vda' bus='virtio'/> </disk> <channel type='pty'> <target type='virtio'/> </channel> <input type='mouse' bus='ps2'/> <graphics type='spice' autoport='yes' listen='0.0.0.0'/> </devices> </domain> EOF # virsh define /tmp/test.xml Domain test defined from /tmp/test.xml # virsh snapshot-list test Name Creation Time State ------------------------------------------------------------ # virsh snapshot-create-as test hello Domain snapshot hello created # virsh snapshot-list test Name Creation Time State ------------------------------------------------------------ hello 2012-03-30 17:30:13 +0800 shutoff # virsh snapshot-current test hello error: End of file while reading data: Input/output error Actual results: # service libvirtd status libvirtd dead but pid file exists Expected results: avoid crashing libvirtd. Additional info: Run till exit from #0 __strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:187 Program received signal SIGSEGV, Segmentation fault. __strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:213 (gdb) bt #0 __strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:213 #1 0x00007f77dee24fd3 in virDomainChannelDefCheckABIStability (src=0x7f77cc1886c0, dst=0x7f77c80d2630) at conf/domain_conf.c:9496 #2 virDomainDefCheckABIStability (src=0x7f77cc1886c0, dst=0x7f77c80d2630) at conf/domain_conf.c:9862 #3 0x000000000044e948 in qemuDomainSnapshotCreateXML (domain=<value optimized out>, xmlDesc=<value optimized out>, flags=<value optimized out>) at qemu/qemu_driver.c:10165 #4 0x00007f77dee78c8c in virDomainSnapshotCreateXML (domain=0x7f77c80bf650, xmlDesc=0x7f77c80c2eb0 "<domainsnapshot>\n <name>hello</name>\n <state>shutoff</state>\n <creationTime>1333095328</creationTime>\n <domain type='kvm'>\n <name>foo-clone</name>\n <uuid>fea1e273-6516-c52c-634a-d735c68524dd"..., flags=3) at libvirt.c:17089 #5 0x000000000042a9ef in remoteDispatchDomainSnapshotCreateXML (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>, rerr=0x7f77d84edbc0, args=0x7f77c80c0130, ret=0x7f77c80c0170) at remote_dispatch.h:5485 #6 remoteDispatchDomainSnapshotCreateXMLHelper (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>, rerr=0x7f77d84edbc0, args=0x7f77c80c0130, ret=0x7f77c80c0170) at remote_dispatch.h:5461 #7 0x00007f77deeb2615 in virNetServerProgramDispatchCall (prog=0x13dbe80, server=0x13d0ac0, client=0x13dc530, msg=0x141ca20) at rpc/virnetserverprogram.c:416 #8 virNetServerProgramDispatch (prog=0x13dbe80, server=0x13d0ac0, client=0x13dc530, msg=0x141ca20) at rpc/virnetserverprogram.c:289 #9 0x00007f77deeb1411 in virNetServerHandleJob (jobOpaque=<value optimized out>, opaque=0x13d0ac0) at rpc/virnetserver.c:164 #10 0x00007f77dedf5bbc in virThreadPoolWorker (opaque=<value optimized out>) at util/threadpool.c:144 #11 0x00007f77dedf54d9 in virThreadHelper (data=<value optimized out>) at util/threads-pthread.c:161 #12 0x00000038baa077f1 in start_thread (arg=0x7f77d84ee700) at pthread_create.c:301 #13 0x00000033f68e570d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115