Bug 1655681 - rbd_snap_list_end() segfaults if rbd_snap_list() fails
Summary: rbd_snap_list_end() segfaults if rbd_snap_list() fails
Alias: None
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: RBD
Version: 3.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: z1
: 3.2
Assignee: Kefu Chai
QA Contact: Manohar Murthy
John Brier
Depends On:
Blocks: 1629656 1655685
TreeView+ depends on / blocked
Reported: 2018-12-03 16:58 UTC by Kefu Chai
Modified: 2019-04-26 19:58 UTC (History)
8 users (show)

Fixed In Version: RHEL: ceph-12.2.8-70.el7cp Ubuntu: ceph_12.2.8-55redhat1
Doc Type: Bug Fix
Doc Text:
.The _python-rbd_ _list_snaps()_ method no longer segfaults after an error This issue was discovered with OpenStack Cinder Backup when `rados_connect_timeout` was set. Normally the timeout is not enabled. If the cluster was highly loaded the timeout could be reached, causing the segfault. With this update to {product}, if the timeout is reached a segfault no longer occurs.
Clone Of:
: 1655685 (view as bug list)
Last Closed: 2019-03-07 15:51:12 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Ceph Project Bug Tracker 37508 0 None None None 2018-12-03 17:00:57 UTC
Red Hat Product Errata RHBA-2019:0475 0 None None None 2019-03-07 15:51:24 UTC

Description Kefu Chai 2018-12-03 16:58:17 UTC
Description of problem:

rbd_snap_list_end() segfaults if rbd_snap_list() fails

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. create an instance of `SnapIterator` using librbd's python binding in a very busy cluster, and rbd_snap_list() returns with ETIMEOUT
2. and `SnapIterator.__dealloc__()` gets called.

Actual results:

SIGSEGV is received. and the program crashes.

Expected results:

an exception is thrown. and the program does not crash.

Additional info:

Comment 11 Kefu Chai 2019-02-20 15:12:36 UTC
Manohar, see the first comment in this bz

SnapIterator's constructor calls `rbd_snap_list()`, and its destructor calls rbd_snap_list_end(). i think what you need is to 

1. # unplug the network cable or whatever way to cut down the connection between your testbed to cluster
2. snap_it = SnapIterator(image)
3  del snap_it

Comment 18 errata-xmlrpc 2019-03-07 15:51:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.