Bug 1456424 - qemu crash when starting image streaming job fails
Summary: qemu crash when starting image streaming job fails
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev
Version: 7.4
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Kevin Wolf
QA Contact: Qianqian Zhu
Depends On:
TreeView+ depends on / blocked
Reported: 2017-05-29 11:41 UTC by Kevin Wolf
Modified: 2017-08-02 04:41 UTC (History)
7 users (show)

Fixed In Version: qemu-kvm-rhev-2.9.0-8.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-08-02 04:41:00 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2392 0 normal SHIPPED_LIVE Important: qemu-kvm-rhev security, bug fix, and enhancement update 2017-08-01 20:04:36 UTC

Description Kevin Wolf 2017-05-29 11:41:08 UTC
If block_job_create() fails for image streaming, qemu crashes with a segfault
(NULL pointer access). This can be reproduced by using the QMP block-stream
command, specifying a node name as 'device' and not providing a job ID.

The problem is fixed upstream with the patch "stream: fix crash in
stream_start() when block_job_create() fails", which is not in git master yet.


$ qemu-img create -f qcow2 /tmp/base.qcow2 64M
$ qemu-img create -f qcow2 -b /tmp/base.qcow2 /tmp/sn1.qcow2
$ qemu-img create -f qcow2 -b /tmp/sn1.qcow2 /tmp/sn2.qcow2
$ qemu-system-x86_64 -drive file=/tmp/sn2.qcow2,backing.node-name=mid -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 0, "minor": 9, "major": 2}, "package": "(v2.9.0-119-gd3498bc)"}, "capabilities": []}}
{"return": {}}
Segmentation fault (core dumped)

Expected result:

{"error": {"class": "GenericError", "desc": "An explicit job ID is required for this node"}}

Comment 1 Qianqian Zhu 2017-05-31 08:33:25 UTC
QE has reproduced this issue on qemu-kvm-rhev-2.9.0-7.el7.x86_64, follow the steps listed in comment 0.

Replace 'backing.node-name=mid' with 'node-name=mid' or 'id=mid' won't trigger core dump.

Comment 2 Miroslav Rezanina 2017-06-06 08:54:56 UTC
Fix included in qemu-kvm-rhev-2.9.0-8.el7

Comment 4 Qianqian Zhu 2017-06-14 02:34:38 UTC
Verified on qemu-kvm-rhev-2.9.0-9.el7.x86_64 following steps from comment 0,
qmp prompt error preventing the block job:
{"error": {"class": "GenericError", "desc": "An explicit job ID is required for this node"}}

Comment 6 Qianqian Zhu 2017-06-14 02:37:18 UTC
Moving to VERIFIED per comment 4 and comment 5.

Comment 8 errata-xmlrpc 2017-08-02 04:41:00 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.