Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1642625

Summary: Crash in libnm when cancelling GCancellable from within activate-connect-async callback
Product: Red Hat Enterprise Linux 7 Reporter: Edward Haas <edwardh>
Component: NetworkManagerAssignee: Thomas Haller <thaller>
Status: CLOSED ERRATA QA Contact: Desktop QE <desktop-qa-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: atragler, bgalvani, fge, fgiudici, fpokryvk, lrintel, rkhan, sukulkar, thaller, vbenes
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: NetworkManager-1.16.2-0.1.20190328git8ec0954570.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1643085 (view as bug list) Environment:
Docker
Last Closed: 2019-08-06 13:16:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1643085    
Attachments:
Description Flags
Core from the pytest run
none
backtrace
none
another backtrace
none
[patch v1] libnm: fix crash in activate_info_complete()
none
Reproducer script.
none
Reproducer script. none

Description Edward Haas 2018-10-24 20:33:05 UTC 
Created attachment 1497216 [details]
Core from the pytest run

Description of problem:
While running integration tests on nmstate with a container, the run crashed and created a core.
Tested with various mtu values on a veth interface inside a container.

Version-Release number of selected component (if applicable):
NetworkManager version 1.10.2-16.el7_5
uname -a: Linux 3c5fbee79551 3.10.0-693.21.1.el7.x86_64 #1 SMP Fri Feb 23 18:54:16 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

How reproducible:
Use https://github.com/nmstate/nmstate to run the integration tests.
./automation/run-integration-tests.sh

The failing tests: https://github.com/nmstate/nmstate/pull/113
(I suspect the invalid mtu values (10,000 , 0, -1, 40)

Reproduced 80% of the times.

Actual results:
Segmentation fault with a core.

Expected results:


Additional info:
Comment 2 Edward Haas 2018-10-24 20:34:15 UTC 
The test which sets mtu=10000 is suspected.
Comment 3 Thomas Haller 2018-10-25 08:22:22 UTC 
Created attachment 1497364 [details]
backtrace
Comment 4 Thomas Haller 2018-10-25 12:48:43 UTC 
Created attachment 1497443 [details]
another backtrace

in this backtrace I patched 1:1.10.2-16.el7_5 to assert if activate_info_complete() is called recursively. And (as expected) it is...
Comment 5 Thomas Haller 2018-10-25 12:57:12 UTC 
Created attachment 1497450 [details]
[patch v1] libnm: fix crash in activate_info_complete()
Comment 6 Beniamino Galvani 2018-10-25 13:06:55 UTC 
(In reply to Thomas Haller from comment #5)
> Created attachment 1497450 [details]
> [patch v1] libnm: fix crash in activate_info_complete()

LGTM
Comment 7 Thomas Haller 2018-10-25 13:33:51 UTC 
fixed upstream:

master:  https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=ec37e18c64ac480fc7c7699e45005894c27c8416
nm-1-14: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=2c6fafad7abe5fe03e6c12f8b650300e47ad9753
nm-1-12: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=3d23e9d68fe3374a453f6f36f50a9e8c49dac68a
nm-1-10: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d1e62e59f673348c5648d192b01b8dd22f42ae8c
Comment 8 Edward Haas 2018-10-27 11:13:33 UTC 
Tested on my environment and no segmentations are seen any more. Thanks!
Comment 9 Thomas Haller 2018-10-28 18:40:43 UTC 
btw, I think this is entirely unrelated to MTU settings... Updated title.
Comment 10 Gris Ge 2018-12-06 12:22:24 UTC 
Created attachment 1512095 [details]
Reproducer script.

Reproducer attached.

```
sudo python ./nm_cancle_in_callback.py
```
Comment 11 Gris Ge 2018-12-10 07:57:12 UTC 
Created attachment 1512954 [details]
Reproducer script.
Comment 17 errata-xmlrpc 2019-08-06 13:16:24 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2302