Bug 1456424 - qemu crash when starting image streaming job fails
Summary: qemu crash when starting image streaming job fails
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev
Version: 7.4
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Kevin Wolf
QA Contact: Qianqian Zhu
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-29 11:41 UTC by Kevin Wolf
Modified: 2017-08-02 04:41 UTC (History)
7 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2017-08-02 04:41:00 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2392 normal SHIPPED_LIVE Important: qemu-kvm-rhev security, bug fix, and enhancement update 2017-08-01 20:04:36 UTC

Description Kevin Wolf 2017-05-29 11:41:08 UTC
If block_job_create() fails for image streaming, qemu crashes with a segfault
(NULL pointer access). This can be reproduced by using the QMP block-stream
command, specifying a node name as 'device' and not providing a job ID.

The problem is fixed upstream with the patch "stream: fix crash in
stream_start() when block_job_create() fails", which is not in git master yet.

Reproducer:

$ qemu-img create -f qcow2 /tmp/base.qcow2 64M
$ qemu-img create -f qcow2 -b /tmp/base.qcow2 /tmp/sn1.qcow2
$ qemu-img create -f qcow2 -b /tmp/sn1.qcow2 /tmp/sn2.qcow2
$ qemu-system-x86_64 -drive file=/tmp/sn2.qcow2,backing.node-name=mid -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 0, "minor": 9, "major": 2}, "package": "(v2.9.0-119-gd3498bc)"}, "capabilities": []}}
{"execute":"qmp_capabilities"}
{"return": {}}
{"execute":"block-stream","arguments":{"device":"mid"}}
Segmentation fault (core dumped)

Expected result:

{"error": {"class": "GenericError", "desc": "An explicit job ID is required for this node"}}

Comment 1 Qianqian Zhu 2017-05-31 08:33:25 UTC
QE has reproduced this issue on qemu-kvm-rhev-2.9.0-7.el7.x86_64, follow the steps listed in comment 0.

Replace 'backing.node-name=mid' with 'node-name=mid' or 'id=mid' won't trigger core dump.

Comment 2 Miroslav Rezanina 2017-06-06 08:54:56 UTC
Fix included in qemu-kvm-rhev-2.9.0-8.el7

Comment 4 Qianqian Zhu 2017-06-14 02:34:38 UTC
Verified on qemu-kvm-rhev-2.9.0-9.el7.x86_64 following steps from comment 0,
Result:
qmp prompt error preventing the block job:
{"error": {"class": "GenericError", "desc": "An explicit job ID is required for this node"}}

Comment 6 Qianqian Zhu 2017-06-14 02:37:18 UTC
Moving to VERIFIED per comment 4 and comment 5.

Comment 8 errata-xmlrpc 2017-08-02 04:41:00 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:2392


Note You need to log in before you can comment on or make changes to this bug.