Bug 817234

Summary: libvirtd crash when start a net with special MAC address
Product: Red Hat Enterprise Linux 6 Reporter: zhpeng
Component: libvirtAssignee: Peter Krempa <pkrempa>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.3CC: acathrow, ajia, cwei, dallan, dyasny, dyuan, mzhan, rwu, veillard, ydu
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: libvirt-0.9.10-17.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 823765 (view as bug list) Environment:
Last Closed: 2012-06-20 06:57:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
libvirtd log none

Description zhpeng 2012-04-28 07:17:47 UTC
Description of Problem:
libvirtd crash when start a net with special MAC address

Version-Release number of selected component:
libvirt-0.9.10-14.el6.x86_64

How reproducible:
Always

Step to Reproduce:
virsh # net-list
Name                 State      Autostart
-----------------------------------------
default              active     yes      

virsh # net-destroy default
Network default destroyed

virsh # net-edit default
Network default XML configuration edited.
<network>
  <name>default</name>
  <uuid>0adda191-5e1a-43ef-9039-240076c9a6ca</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <mac address='FF:FFDD:EE:EE'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
    </dhcp>
  </ip>
</network>


virsh # net-start default
error: Failed to start network default
error: End of file while reading data: Input/output error

[root@zhpeng ~]# service libvirtd status
libvirtd dead but pid file exists


Actual Results:
libvirtd crashed

Expected Results:
no crash

Additional info:

Comment 1 zhpeng 2012-04-28 07:19:29 UTC
Created attachment 580941 [details]
libvirtd log

Comment 2 zhpeng 2012-04-28 07:26:38 UTC
One more problem:

Before i do these steps, the encode of libvirtd log is good, i can use gedit open libvirtd.log. But after i do these steps, many debug info write into the libvirtd.log and i can't use gedit open it. But i can use tail/less/vim read it.

Comment 3 Alex Jia 2012-04-28 08:10:20 UTC
(In reply to comment #0)
> 
> virsh # net-edit default
> Network default XML configuration edited.
> <network>
>   <name>default</name>
>   <uuid>0adda191-5e1a-43ef-9039-240076c9a6ca</uuid>
>   <forward mode='nat'/>
>   <bridge name='virbr0' stp='on' delay='0' />
>   <mac address='FF:FFDD:EE:EE'/>
It should be "<mac address='FF:FF:DD:DD:EE:EE'/>", copy-paste eats your ":DD:" in Zimbra, in addition, if you edit above line into default network on libvirt upstream, as expected, libvirt will raise the following error:

# virsh net-edit default
error: XML error: Invalid multicast bridge mac address 'FF:FF:DD:DD:EE:EE' in network 'default'

I tried to use '00:00:00:00:00' mac address, I can also reproduce the issue on libvirt upstream, however, it isn't reproducible every time.


And this issue is resulted by VIR_FORCE_CLOSE() deref a NULL 'tapfd' in virNetDevTapCreateInBridgePort() from src/util/virnetdevtap.c, I will try to fix it firstly.

Comment 4 Alex Jia 2012-05-02 02:49:15 UTC
In POST:

commit 5ee18aaa578768893918d67e0dc36fe72b73b736
Author: Alex Jia <ajia>
Date:   Sat Apr 28 19:01:40 2012 +0800

    util: Avoid libvirtd crash in virNetDevTapCreate
    
    In fact, the 'tapfd' is always NULL, the function 'virNetDevTapCreate()' hasn't
    assign 'fd' to 'tapfd', when the function 'virNetDevSetMAC()' is failed then
    goto 'error' label, finally, the VIR_FORCE_CLOSE() will deref a NULL 'tapfd'.
    
    * util/virnetdevtap.c (virNetDevTapCreateInBridgePort): fix a NULL pointer derefing.
    
    * How to reproduce?
    
    $ cat > /tmp/net.xml <<EOF
    <network>
      <name>test</name>
      <forward mode='nat'/>
      <bridge name='br1' stp='off' delay='1' />
      <mac address='00:00:00:00:00:00'/>
      <ip address='192.168.100.1' netmask='255.255.255.0'>
        <dhcp>
          <range start='192.168.100.2' end='192.168.100.254' />
        </dhcp>
      </ip>
    </network>
    EOF
    
    $ virsh net-define /tmp/net.xml
    
    $ virsh net-start test
    error: Failed to start network brTest
    error: End of file while reading data: Input/output error
    
    Signed-off-by: Alex Jia <ajia>

Comment 9 yanbing du 2012-05-11 05:24:59 UTC
Hi ajia, 
  I used libvirt-0.9.10-18.el6.x86_64 to test this bug, results like following:
Edit the 'default' network with 00:00:00:00:00:00 mac address, then 
# virsh net-start default
Network default started
# virsh net-dumpxml default
<network>
  <name>default</name>
  <uuid>8738a311-6441-4c1b-ac31-13f881044c7a</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <mac address='00:00:00:00:00:00'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
    </dhcp>
  </ip>
</network>
# ifconfig|grep HWaddr|grep virbr0
virbr0    Link encap:Ethernet  HWaddr 32:DA:C9:FF:89:85 

and check the libvirtd log, always 3 errors output:
#tail -f /var/log/libvirt/libvirtd.log 
012-05-11 05:10:22.044+0000: 12555: error : virCommandWait:2308 : internal error Child process (/sbin/tc qdisc del dev virbr0 root) status unexpected: exit status 2
2012-05-11 05:10:22.047+0000: 12555: error : virCommandWait:2308 : internal error Child process (/sbin/tc qdisc del dev virbr0 ingress) status unexpected: exit status 2
2012-05-11 05:10:50.603+0000: 12551: error : virNetDevSetMAC:170 : Cannot set interface MAC on 'virbr0-nic': Cannot assign requested address

Both '00:00:00:00:00:00' and 'FF:FF:FF:FF:EE:EE' these special mac address have the same result, that means the new mac address don't take effect. So if this behavior is expected?

Comment 10 Alex Jia 2012-05-11 05:39:35 UTC
(In reply to comment #9)
> and check the libvirtd log, always 3 errors output:
> #tail -f /var/log/libvirt/libvirtd.log 
> 012-05-11 05:10:22.044+0000: 12555: error : virCommandWait:2308 : internal
> error Child process (/sbin/tc qdisc del dev virbr0 root) status unexpected:
> exit status 2
> 2012-05-11 05:10:22.047+0000: 12555: error : virCommandWait:2308 : internal
> error Child process (/sbin/tc qdisc del dev virbr0 ingress) status unexpected:
> exit status 2
> 2012-05-11 05:10:50.603+0000: 12551: error : virNetDevSetMAC:170 : Cannot set
> interface MAC on 'virbr0-nic': Cannot assign requested address
> 
> Both '00:00:00:00:00:00' and 'FF:FF:FF:FF:EE:EE' these special mac address have
> the same result, that means the new mac address don't take effect. So if this
> behavior is expected?

The previous patch is used for fixing libvirtd crash for special MAC address, if libvirt hasn't crash again, I think we may move the bug to VERIFIED status.

Alex->Peter, please help confirm this, thanks.

In addition, please see Comment 3, if we give some special MAC address by net-edit then we can get some expected error message, for example, "Invalid multicast bridge mac address 'FF:FF:DD:DD:EE:EE'", so I think if we can't assign MAC address, virsh net-define or virsh net-start should raise a similar error information like virsh net-edit.

Comment 11 yanbing du 2012-05-22 06:19:00 UTC
According comment 9 and 10, since libvirtd will not crash, move this bug to VERIFY. 
BTW, filed a new bug 823765 to track the problem mentioned in comment 10.

Comment 13 errata-xmlrpc 2012-06-20 06:57:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0748.html