Bug 895882

Summary: invalid domain pointer error occurs when use domain object from snapshot object 's getdomain method
Product: Red Hat Enterprise Linux 6 Reporter: hongming <honzhang>
Component: libvirtAssignee: Jiri Denemark <jdenemar>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 6.4CC: acathrow, ajia, cwei, dallan, dyuan, gsun, jdenemar, mzhan
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libvirt-0.10.2-19.el6 Doc Type: Bug Fix
Doc Text:
Cause: Python bindings for libvirt contained incorrect implementation of getDomain() and getConnect() methods in virDomainSnapshot class. Consequence: An application using these methods may fail or crash. Fix: Python bindings now provide proper domain() and connect() accessors that fetch python objects stored internally within virDomainSnapshot instance. For backward compatibility, getDomain() and getConnect() methods call these accessors. Result: An application using either of these methods works as expected.
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-21 08:39:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 915348    

Description hongming 2013-01-16 08:23:07 UTC
Description of problem:
The following error  occurs when use domain object from snapshot object 's getdomain method
libvir: Domain error : invalid domain pointer in virDomainFree

When looping through snapshot list , the following error occurs.
libvir: Domain Snapshot error : Invalid snapshot: virDomainSnapshotFree

Version-Release number of selected component (if applicable):
libvirt-python-0.10.2-15.el6.x86_64

How reproducible:
100% 

Steps to Reproduce:
# virsh snapshot-list snapshot
 Name                 Creation Time             State
------------------------------------------------------------
 1358243306           2013-01-15 17:48:26 +0800 running
 1358243555           2013-01-15 17:52:35 +0800 running

# cat snapshot.py

#!/usr/bin/env python
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('snapshot')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list:%s" % snapshot_list
    domain = snapshot_list[0].getDomain()
    domain_name = domain.name()
    print "domain name:%s" % domain_name

if __name__=='__main__':


# python snapshot.py
snapshot object list:[<libvirt.virDomainSnapshot instance at 0x7f2202d3fea8>, <libvirt.virDomainSnapshot instance at 0x7f2202d3fef0>]
domain name:snapshot
libvir: Domain error : invalid domain pointer in virDomainFree



# cat snapshot1.py

#!/usr/bin/env python
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('snapshot')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list: %s" % snapshot_list
    for snapshot_item in snapshot_list:
        domain = snapshot_item.getDomain()
        print "domain name: %s " % domain.name()

if __name__=='__main__':
    snapshot()


# python snapshot1.py
snapshot object list: [<libvirt.virDomainSnapshot instance at 0x7fb9e89d1ef0>, <libvirt.virDomainSnapshot instance at 0x7fb9e89d1f38>]
domain name: snapshot
domain name: snapshot
libvir: Domain Snapshot error : Invalid snapshot: virDomainSnapshotFree
libvir: Domain error : invalid domain pointer in virDomainFree

Actual results:
as above 

Expected results:
It works fine

Additional info:

Comment 3 Jiri Denemark 2013-01-22 13:38:06 UTC
The bus is also reproducible upstream, although the python client segfaults there rather than reporting invalid pointers.

In any case, we have a nasty bug in python bindings. virDomainSnapshotGetDomain() API (called as snapshot.getDomain() in python) returns the domain object but does not increment its reference counter. However, we just take it and wrap it as virDomain object in python and once the object is deleted, it calls virDomainFree. And virDomainFree is called once more when the snapshot object is deleted (as it holds a reference to the domain). Thus, before creating a virDomain object from the domain pointer returned by virDomainSnapshotGetDomain, we need to call virDomainRef to increment its reference counter.

Unfortunately, it seems virDomainSnapshotGetDomain API is not the only one affected and we have similar bugs in other APIs too.

Comment 5 Jiri Denemark 2013-01-25 16:58:00 UTC
Fixed upstream by v1.0.2-rc1-6-g7b35fd7:

commit 7b35fd718d2156224797ace08f752dfbb9884520
Author: Jiri Denemark <jdenemar>
Date:   Wed Jan 23 12:14:57 2013 +0100

    python: Fix bindings for virDomainSnapshotGet{Domain,Connect}
    
    https://bugzilla.redhat.com/show_bug.cgi?id=895882
    
    virDomainSnapshot.getDomain() and virDomainSnapshot.getConnect()
    wrappers around virDomainSnapshotGet{Domain,Connect} were not supposed
    to be ever implemented. The class should contain proper domain() and
    connect() accessors that fetch python objects stored internally within
    the class. While domain() was already provided, connect() was missing.
    
    This patch adds connect() method to virDomainSnapshot class and
    reimplements getDomain() and getConnect() methods as aliases to domain()
    and connect() for backward compatibility.

Comment 8 hongming 2013-07-09 06:34:13 UTC
Verify it as follows. The result is expected. 

# rpm -q libvirt-python
libvirt-python-0.10.2-19.el6.x86_64


# virsh snapshot-list kvm-rhel6.4-x86_64-qcow2-virtio
 Name                 Creation Time             State
------------------------------------------------------------
 1373349897           2013-07-09 02:04:57 -0400 running
 1373349908           2013-07-09 02:05:08 -0400 running


# cat snapshot.py
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('kvm-rhel6.4-x86_64-qcow2-virtio')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list:%s" % snapshot_list
    domain = snapshot_list[0].getDomain()
    domain_name = domain.name()
    print "domain name:%s" % domain_name
if __name__=='__main__':
    snapshot()

# python snapshot.py
snapshot object list:[<libvirt.virDomainSnapshot instance at 0x7fb2cb9a0e18>, <libvirt.virDomainSnapshot instance at 0x7fb2cb9a0e60>]
domain name:kvm-rhel6.4-x86_64-qcow2-virtio


# cat snapshot1.py 
#!/usr/bin/env python
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('kvm-rhel6.4-x86_64-qcow2-virtio')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list: %s" % snapshot_list
    for snapshot_item in snapshot_list:
        domain = snapshot_item.getDomain()
        print "domain name: %s " % domain.name()

if __name__=='__main__':
    snapshot()

# python snapshot1.py
snapshot object list: [<libvirt.virDomainSnapshot instance at 0x7fa941a7ae60>, <libvirt.virDomainSnapshot instance at 0x7fa941a7aea8>]
domain name: kvm-rhel6.4-x86_64-qcow2-virtio 
domain name: kvm-rhel6.4-x86_64-qcow2-virtio

Comment 10 errata-xmlrpc 2013-11-21 08:39:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1581.html