Bug 908073
| Summary: | Crash changing CDROM device media | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Daniel Berrangé <berrange> |
| Component: | libvirt | Assignee: | Osier Yang <jyang> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 6.4 | CC: | acathrow, chhu, cpelland, cwei, dallan, dyuan, gsun, lsu, mzhan, nachandr, shyu, weizhan |
| Target Milestone: | rc | Keywords: | Regression, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-0.10.2-19.el6 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: Dereference pointers (E.g. disk def) which might be already freed.
Consequence: Regressions like libvirtd crashing
Fix: Add various checking to avoid dereferencing NULL pointers. And also copy the disk def before changing CD-ROM
or Floppy medium.
Result: The crash is fixed.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-11-21 08:44:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 919504 | ||
|
Description
Daniel Berrangé
2013-02-05 19:18:22 UTC
libvirtd crash when I start the guest with shareable block cdrom.
<disk type='block' device='cdrom'>
<driver name='qemu' type='raw'/>
<target dev='hdc' bus='ide'/>
<readonly/>
<shareable/>
<address type='drive' controller='0' bus='1' target='0' unit='0'/>
</disk>
(gdb) bt
#0 virFileResolveLinkHelper (linkpath=0x0, intermediatePaths=false, resultpath=0x7ffff13171d8) at util/util.c:557
#1 0x0000003f0a6670a8 in virGetDeviceID (path=<value optimized out>, maj=0x7ffff131721c, min=0x7ffff1317218) at util/util.c:3149
#2 0x0000000000477da1 in qemuGetSharedDiskKey (disk_path=0x0) at qemu/qemu_conf.c:757
#3 0x0000000000477ef9 in qemuAddSharedDisk (sharedDisks=0x7fffe401c870, disk_path=<value optimized out>) at qemu/qemu_conf.c:782
#4 0x0000000000481dc4 in qemuProcessStart (conn=0x7fffcc001300, driver=0x7fffe40ba120, vm=0x7fffe4012cc0, migrateFrom=0x0, stdin_fd=-1,
stdin_path=0x0, snapshot=0x0, vmop=VIR_NETDEV_VPORT_PROFILE_OP_CREATE, flags=1) at qemu/qemu_process.c:3856
#5 0x000000000046a9de in qemuDomainObjStart (conn=0x7fffcc001300, driver=0x7fffe40ba120, vm=0x7fffe4012cc0, flags=<value optimized out>)
at qemu/qemu_driver.c:5610
#6 0x000000000046afd2 in qemuDomainStartWithFlags (dom=0x7fffd00008c0, flags=0) at qemu/qemu_driver.c:5667
#7 0x0000003f0a6f2970 in virDomainCreate (domain=0x7fffd00008c0) at libvirt.c:8303
#8 0x000000000043fbe2 in remoteDispatchDomainCreate (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>,
rerr=0x7ffff1317b80, args=<value optimized out>, ret=<value optimized out>) at remote_dispatch.h:1066
#9 remoteDispatchDomainCreateHelper (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>,
rerr=0x7ffff1317b80, args=<value optimized out>, ret=<value optimized out>) at remote_dispatch.h:1044
#10 0x0000003f0a73f162 in virNetServerProgramDispatchCall (prog=0x7a13f0, server=0x796010, client=0x79e220, msg=0x79de30)
at rpc/virnetserverprogram.c:431
#11 virNetServerProgramDispatch (prog=0x7a13f0, server=0x796010, client=0x79e220, msg=0x79de30) at rpc/virnetserverprogram.c:304
#12 0x0000003f0a73fdfe in virNetServerProcessMsg (srv=<value optimized out>, client=0x79e220, prog=<value optimized out>, msg=0x79de30)
at rpc/virnetserver.c:170
#13 0x0000003f0a74049c in virNetServerHandleJob (jobOpaque=<value optimized out>, opaque=<value optimized out>) at rpc/virnetserver.c:191
#14 0x0000003f0a662c4c in virThreadPoolWorker (opaque=<value optimized out>) at util/threadpool.c:144
#15 0x0000003f0a662539 in virThreadHelper (data=<value optimized out>) at util/threads-pthread.c:161
#16 0x0000003ef2807851 in start_thread () from /lib64/libpthread.so.0
#17 0x0000003ef20e890d in clone () from /lib64/libc.so.6
And it works fine with libvirt-0.10.2-12.el6. The further problem in this code in qemuDomainAttachDeviceDiskLive:
if (ret == 0) {
if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && disk->shared) {
if (qemuAddSharedDisk(driver->sharedDisks, disk->src) < 0)
VIR_WARN("Failed to add disk '%s' to shared disk table",
disk->src);
}
if (qemuSetUnprivSGIO(disk) < 0)
VIR_WARN("Failed to set unpriv_sgio of disk '%s'", disk->src);
}
is that it is racy with the guest. By the time we get to this point, we have already assigned the device to the guest, and it can be doing I/O. We need to do all setup work *prior* to assigning the device to the guest.
commit 02b9097274d1330c2e1dca7f598880e09b5c2aa0
Author: Daniel P. Berrange <berrange>
Date: Mon Feb 25 17:22:14 2013 +0000
Fix crash changing CDROM media
This change tried to fix a crash with changing CDROM media but
failed to actually do so
commit d0172d2b1b5d865aaa042070d7c2d00effb2ff8c
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:45 2013 +0800
qemu: Remove the shared disk entry if the operation is ejecting or updating
It was still accessing disk->src, when the entire 'disk' object
has been free'd already. Even if it weren't free'd, accessing
the 'src' value of virDomainDiskDef is not allowed without
first validating disk->type is file or block. Just remove the
broken code entirely.
Signed-off-by: Daniel P. Berrange <berrange>
commit 5c9034bf055d043672be5da8af453e5ddc3906d3
Author: Osier Yang <jyang>
Date: Thu Feb 21 10:32:15 2013 +0800
qemu: Fix the memory leak
Found by John Ferlan (coverity script)
commit d0172d2b1b5d865aaa042070d7c2d00effb2ff8c
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:45 2013 +0800
qemu: Remove the shared disk entry if the operation is ejecting or updating
For both AttachDevice and UpdateDevice APIs, if the disk device
is 'cdrom' or 'floppy', the operations could be ejecting, updating,
and inserting. For either ejecting or updating, the shared disk
entry of the original disk src has to be removed, because it's
not useful anymore.
And since the original disk def will be changed, new disk def passed
as argument will be free'ed in qemuDomainChangeEjectableMedia, so
we need to copy the orignal disk def before
qemuDomainChangeEjectableMedia, to use it for qemuRemoveSharedDisk.
commit 0db7ff59cc419d9859925e1324f021f59e2fe260
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:44 2013 +0800
qemu: Move the shared disk adding and sgio setting prior to attaching
The disk def could be free'ed by qemuDomainChangeEjectableMedia,
which can thus cause crash if we reference the disk pointer. On
the other hand, we have to remove the added shared disk entry from
the table on error codepath.
commit d0e4b762042e8f71c24ee93312ee3a131dcd0335
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:43 2013 +0800
qemu: Update shared disk table when reconnecting qemu process
commit a4504ac184c8fa5c30856a58e2f26f1a5db3fb90
Author: Osier Yang <jyang>
Date: Wed Feb 20 15:43:55 2013 +0800
qemu: Record names of domain which uses the shared disk in hash table
The hash entry is changed from "ref" to {ref, @domains}. With this, the
caller can simply call qemuRemoveSharedDisk, without afraid of removing
the entry belongs to other domains. qemuProcessStart will obviously
benifit from it on error codepath (which calls qemuProcessStop to do
the cleanup).
commit 371df778ebe53e649640d6cd27027856c852e5cc
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:41 2013 +0800
qemu: Merge qemuCheckSharedDisk into qemuAddSharedDisk
Based on moving various checking into qemuAddSharedDisk, this
avoids the caller using it in wrong ways. Also this adds two
new checking for qemuCheckSharedDisk (disk device not 'lun'
and kernel doesn't support unpriv_sgio simply returns 0).
commit dab878a861cdcdd7bade2fdac672fec7c128cdb7
Author: Osier Yang <jyang>
Date: Tue Feb 19 20:27:40 2013 +0800
qemu: Add checking in helpers for sgio setting
This moves the various checking into the helpers, to avoid the
callers missing the checking.
Commits are now in upstream, move to POST.
*** Bug 925977 has been marked as a duplicate of this bug. *** packages:
libvirt-0.10.2-19.el6.x86_64
kernel-2.6.32-396.el6.x86_64
1.
Start a guest that have
<disk type='block' device='cdrom'>
<driver name='qemu' type='raw'/>
<target dev='hdc' bus='ide'/>
<readonly/>
<shareable/>
<address type='drive' controller='0' bus='1' target='0' unit='0'/>
</disk>
2.
in libvirt-0.10.2-18.el6.x86_64 , the libvirtd crashed
in libvirt-0.10.2-19.el6.x86_64 , everything works fine , guest started ,
libvirtd is running , no error log.
So set this bug VERIFIED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1581.html |