Hide Forgot
Description of problem: when networking gets disabled, NM clears the ifindex from the device. at the same time there is router advertisement, and NM tries to start DHCPv6 on the interface [root@n22 NetworkManager-ci]# coredumpctl gdb PID: 53675 (NetworkManager) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Thu 2021-06-17 11:51:47 BST (9min ago) Command Line: /usr/sbin/NetworkManager --no-daemon Executable: /usr/sbin/NetworkManager Control Group: /system.slice/NetworkManager.service Unit: NetworkManager.service Slice: system.slice Boot ID: ae529821c5cc4ff09ce24ce6fd18b850 Machine ID: 3752b84a6af346e1a82d521d6f91faf0 Hostname: n22.dusty.ci.centos.org Storage: /var/lib/systemd/coredump/core.NetworkManager.0.ae529821c5cc4ff09ce24ce6fd18b850.53675.1623927107000000.lz4 Message: Process 53675 (NetworkManager) of user 0 dumped core. Stack trace of thread 53675: #0 0x0000564cb4b40876 dhcp6_start_with_link_ready (NetworkManager) #1 0x0000564cb4b40b38 dhcp6_start (NetworkManager) #2 0x0000564cb4b48a0a ndisc_config_changed (NetworkManager) #3 0x00007f1e71da409e ffi_call_unix64 (libffi.so.6) #4 0x00007f1e71da3a4f ffi_call (libffi.so.6) #5 0x00007f1e77307386 g_cclosure_marshal_generic_va (libgobject-2.0.so.0) #6 0x00007f1e77306616 _g_closure_invoke_va (libgobject-2.0.so.0) #7 0x00007f1e77322a9c g_signal_emit_valist (libgobject-2.0.so.0) #8 0x00007f1e77323093 g_signal_emit (libgobject-2.0.so.0) #9 0x0000564cb4bf4f7b check_timestamps (NetworkManager) #10 0x0000564cb4beec80 receive_ra (NetworkManager) #11 0x00007f1e77fd88a3 ndp_call_eventfd_handler (libndp.so.0) #12 0x00007f1e77fd899f ndp_callall_eventfd_handler (libndp.so.0) #13 0x0000564cb4bf0159 event_ready (NetworkManager) #14 0x00007f1e76e2687d g_main_context_dispatch (libglib-2.0.so.0) #15 0x00007f1e76e26c38 g_main_context_iterate.isra.21 (libglib-2.0.so.0) #16 0x00007f1e76e26f62 g_main_loop_run (libglib-2.0.so.0) #17 0x0000564cb494e060 main (NetworkManager) #18 0x00007f1e763fb493 __libc_start_main (libc.so.6) #19 0x0000564cb494e1ce _start (NetworkManager) Stack trace of thread 53677: #0 0x00007f1e764c9a41 __poll (libc.so.6) #1 0x00007f1e76e26ba6 g_main_context_iterate.isra.21 (libglib-2.0.so.0) #2 0x00007f1e76e26f62 g_main_loop_run (libglib-2.0.so.0) #3 0x00007f1e776205da gdbus_shared_thread_func (libgio-2.0.so.0) #4 0x00007f1e76e4eeea g_thread_proxy (libglib-2.0.so.0) #5 0x00007f1e767a514a start_thread (libpthread.so.0) #6 0x00007f1e764d4dc3 __clone (libc.so.6) Stack trace of thread 53682: #0 0x00007f1e764cf52d syscall (libc.so.6) #1 0x00007f1e76e6dd5e g_cond_wait_until (libglib-2.0.so.0) #2 0x00007f1e76df9131 g_async_queue_pop_intern_unlocked (libglib-2.0.so.0) #3 0x00007f1e76df9720 g_async_queue_timeout_pop (libglib-2.0.so.0) #4 0x00007f1e76e4f991 g_thread_pool_thread_proxy (libglib-2.0.so.0) #5 0x00007f1e76e4eeea g_thread_proxy (libglib-2.0.so.0) #6 0x00007f1e767a514a start_thread (libpthread.so.0) #7 0x00007f1e764d4dc3 __clone (libc.so.6) Stack trace of thread 53676: #0 0x00007f1e764c9a41 __poll (libc.so.6) #1 0x00007f1e76e26ba6 g_main_context_iterate.isra.21 (libglib-2.0.so.0) #2 0x00007f1e76e26cd0 g_main_context_iteration (libglib-2.0.so.0) #3 0x00007f1e76e26d21 glib_worker_main (libglib-2.0.so.0) #4 0x00007f1e76e4eeea g_thread_proxy (libglib-2.0.so.0) #5 0x00007f1e767a514a start_thread (libpthread.so.0) #6 0x00007f1e764d4dc3 __clone (libc.so.6) GNU gdb (GDB) Red Hat Enterprise Linux 8.2-15.el8 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/sbin/NetworkManager...Reading symbols from /usr/lib/debug/usr/sbin/NetworkManager-1.33.1-28603.copr.161cf11cb1.el8.x86_64.debug...done. done. [New LWP 53675] [New LWP 53677] [New LWP 53682] [New LWP 53676] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/usr/sbin/NetworkManager --no-daemon'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000564cb4b40876 in dhcp6_start_with_link_ready (self=0x564cb5efe7a0, connection=<optimized out>) at src/core/devices/nm-device.c:9938 9938 _LOGW(LOGD_DHCP6, "failure to start DHCPv6: %s", error->message); [Current thread is 1 (Thread 0x7f1e78db63c0 (LWP 53675))] Missing separate debuginfos, use: yum debuginfo-install bluez-libs-5.56-1.el8.x86_64 glib2-2.56.4-13.el8.x86_64 libcap-ng-0.7.11-1.el8.x86_64 libgcc-8.5.0-1.el8.x86_64 lz4-libs-1.8.3-3.el8.x86_64 openssl-libs-1.1.1k-1.el8.x86_64 pcre-8.42-6.el8.x86_64 pcre2-10.32-2.el8.x86_64 sssd-client-2.4.0-9.el8_4.1.x86_64 (gdb) t a a bt full Thread 4 (Thread 0x7f1e70222700 (LWP 53676)): #0 0x00007f1e764c9a41 in __GI___poll (fds=0x564cb5d1ef20, nfds=2, timeout=3996) at ../sysdeps/unix/sysv/linux/poll.c:29 resultvar = 18446744073709551100 sc_cancel_oldtype = 0 #1 0x00007f1e76e26ba6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0 #2 0x00007f1e76e26cd0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0 #3 0x00007f1e76e26d21 in glib_worker_main () at /lib64/libglib-2.0.so.0 #4 0x00007f1e76e4eeea in g_thread_proxy () at /lib64/libglib-2.0.so.0 #5 0x00007f1e767a514a in start_thread (arg=<optimized out>) at pthread_create.c:479 ret = <optimized out> pd = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139768707032832, 272587457079542141, 140721629373790, 140721629373791, 140721629373920, 139768707029696, -147338281297378947, -147351954003721859}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #6 0x00007f1e764d4dc3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 3 (Thread 0x7f1e6f220700 (LWP 53682)): #0 0x00007f1e764cf52d in syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38 #1 0x00007f1e76e6dd5e in g_cond_wait_until () at /lib64/libglib-2.0.so.0 #2 0x00007f1e76df9131 in g_async_queue_pop_intern_unlocked () at /lib64/libglib-2.0.so.0 #3 0x00007f1e76df9720 in g_async_queue_timeout_pop () at /lib64/libglib-2.0.so.0 #4 0x00007f1e76e4f991 in g_thread_pool_thread_proxy () at /lib64/libglib-2.0.so.0 #5 0x00007f1e76e4eeea in g_thread_proxy () at /lib64/libglib-2.0.so.0 #6 0x00007f1e767a514a in start_thread (arg=<optimized out>) at pthread_create.c:479 ret = <optimized out> pd = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139768690247424, 272587457079542141, 140721629371790, 140721629371791, 140721629371920, 139768690244288, -147296509519199875, -147351954003721859}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #7 0x00007f1e764d4dc3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 2 (Thread 0x7f1e6fa21700 (LWP 53677)): #0 0x00007f1e764c9a41 in __GI___poll (fds=0x564cb5d2fcd0, nfds=3, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29 resultvar = 18446744073709551100 sc_cancel_oldtype = 0 #1 0x00007f1e76e26ba6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0 #2 0x00007f1e76e26f62 in g_main_loop_run () at /lib64/libglib-2.0.so.0 #3 0x00007f1e776205da in gdbus_shared_thread_func () at /lib64/libgio-2.0.so.0 #4 0x00007f1e76e4eeea in g_thread_proxy () at /lib64/libglib-2.0.so.0 #5 0x00007f1e767a514a in start_thread (arg=<optimized out>) at pthread_create.c:479 ret = <optimized out> pd = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139768698640128, 272587457079542141, 140721629374094, 140721629374095, 140721629374224, 139768698636992, -147295400880766595, -147351954003721859}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #6 0x00007f1e764d4dc3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 1 (Thread 0x7f1e78db63c0 (LWP 53675)): #0 0x0000564cb4b40876 in dhcp6_start_with_link_ready (self=0x564cb5efe7a0, connection=<optimized out>) at src/core/devices/nm-device.c:9938 __prefix = 0x564cb4c3a654 "device" _self = 0x564cb5efe7a0 --Type <RET> for more, q to quit, c to continue without paging-- _ifname = 0x564cb5e60fe0 "iface0" _level = LOGL_WARN _domain = LOGD_DHCP6 priv = 0x564cb5efe2d0 __func__ = "dhcp6_start_with_link_ready" s_ip6 = <optimized out> hwaddr = 0x0 duid = 0x564cb5e64090 enforce_duid = 0 pllink = <optimized out> mud_url_free = 0x0 error = 0x0 iaid = 2395044251 iaid_explicit = 0 s_con = <optimized out> ll_addr = <optimized out> #1 0x0000564cb4b40b38 in dhcp6_start (self=self@entry=0x564cb5efe7a0, wait_for_ll=wait_for_ll@entry=0) at src/core/devices/nm-device.c:9985 priv = <optimized out> __func__ = "dhcp6_start" connection = 0x7f1e60001d00 #2 0x0000564cb4b48a0a in ndisc_config_changed (ndisc=<optimized out>, rdata=0x564cb5e5ee60, changed_int=159, self=0x564cb5efe7a0) at src/core/devices/nm-device.c:10780 changed = (NM_NDISC_CONFIG_DHCP_LEVEL | NM_NDISC_CONFIG_GATEWAYS | NM_NDISC_CONFIG_ADDRESSES | NM_NDISC_CONFIG_ROUTES | NM_NDISC_CONFIG_DNS_SERVERS | NM_NDISC_CONFIG_MTU) priv = 0x564cb5efe2d0 __func__ = "ndisc_config_changed" i = <optimized out> #3 0x00007f1e71da409e in ffi_call_unix64 () at ../src/x86/unix64.S:76 #4 0x00007f1e71da3a4f in ffi_call (cif=<optimized out>, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>) at ../src/x86/ffi64.c:525 classes = {X86_64_INTEGER_CLASS, 926036018, 3051219456, 22092} stack = <optimized out> argp = <optimized out> arg_types = <optimized out> gprcount = <optimized out> ssecount = <optimized out> ngpr = 1 nsse = 0 i = <optimized out> avn = <optimized out> ret_in_memory = <optimized out> reg_args = <optimized out> #5 0x00007f1e77307386 in g_cclosure_marshal_generic_va () at /lib64/libgobject-2.0.so.0 #6 0x00007f1e77306616 in _g_closure_invoke_va () at /lib64/libgobject-2.0.so.0 #7 0x00007f1e77322a9c in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0 #8 0x00007f1e77323093 in g_signal_emit () at /lib64/libgobject-2.0.so.0 #9 0x0000564cb4bf4f7b in check_timestamps (ndisc=ndisc@entry=0x564cb5e5ef60, now_msec=now_msec@entry=14686, changed=changed@entry=(NM_NDISC_CONFIG_DHCP_LEVEL | NM_NDISC_CONFIG_GATEWAYS | NM_NDISC_CONFIG_ADDRESSES | NM_NDISC_CONFIG_ROUTES | NM_NDISC_CONFIG_DNS_SERVERS | NM_NDISC_CONFIG_MTU)) at src/core/ndisc/nm-ndisc.c:1539 priv = <optimized out> __func__ = "check_timestamps" next_msec = <optimized out> #10 0x0000564cb4bf6800 in nm_ndisc_ra_received (ndisc=ndisc@entry=0x564cb5e5ef60, now_msec=now_msec@entry=14686, changed=changed@entry=(NM_NDISC_CONFIG_DHCP_LEVEL | NM_NDISC_CONFIG_GATEWAYS | NM_NDISC_CONFIG_ADDRESSES | NM_NDISC_CONFIG_ROUTES | NM_NDISC_CONFIG_DNS_SERVERS | NM_NDISC_CONFIG_MTU)) at src/core/ndisc/nm-ndisc.c:1556 priv = <optimized out> __func__ = "nm_ndisc_ra_received" #11 0x0000564cb4beec80 in receive_ra (ndp=<optimized out>, msg=0x564cb5f35f30, user_data=<optimized out>) at src/core/ndisc/nm-lndp-ndisc.c:333 --Type <RET> for more, q to quit, c to continue without paging-- ndisc = <optimized out> rdata = 0x564cb5e5ee60 changed = (NM_NDISC_CONFIG_DHCP_LEVEL | NM_NDISC_CONFIG_GATEWAYS | NM_NDISC_CONFIG_ADDRESSES | NM_NDISC_CONFIG_ROUTES | NM_NDISC_CONFIG_DNS_SERVERS | NM_NDISC_CONFIG_MTU) msgra = 0x564cb5f36540 gateway_addr = {__in6_u = {__u6_addr8 = {254 '\376', 128 '\200', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>}, __u6_addr16 = {33022, 0, 0, 0, <optimized out>, <optimized out>, <optimized out>, <optimized out>}, __u6_addr32 = {33022, 0, <optimized out>, <optimized out>}}} now_msec = <optimized out> offset = -1 hop_limit = <optimized out> val = <optimized out> __func__ = "receive_ra" #12 0x00007f1e77fd88a3 in ndp_call_handlers (msg=0x564cb5f35f30, ndp=0x564cb5e03990) at libndp.c:1993 handler_item = 0x564cb5e77b20 err = <optimized out> msg = 0x564cb5f35f30 len = <optimized out> err = 0 __FUNCTION__ = "ndp_sock_recv" #13 0x00007f1e77fd88a3 in ndp_sock_recv (ndp=0x564cb5e03990) at libndp.c:1871 msg = 0x564cb5f35f30 len = <optimized out> err = 0 __FUNCTION__ = "ndp_sock_recv" #14 0x00007f1e77fd88a3 in ndp_call_eventfd_handler (ndp=ndp@entry=0x564cb5e03990) at libndp.c:2097 #15 0x00007f1e77fd899f in ndp_callall_eventfd_handler (ndp=0x564cb5e03990) at libndp.c:2126 pfd = {fd = 29, events = 1, revents = 1} ret = <optimized out> err = <optimized out> #16 0x0000564cb4bf0159 in event_ready (fd=<optimized out>, condition=<optimized out>, user_data=<optimized out>) at src/core/ndisc/nm-lndp-ndisc.c:588 ndisc = 0x564cb5e5ef60 netns = 0x0 priv = 0x564cb5e5ef80 __func__ = "event_ready" #17 0x00007f1e76e2687d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #18 0x00007f1e76e26c38 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0 #19 0x00007f1e76e26f62 in g_main_loop_run () at /lib64/libglib-2.0.so.0 #20 0x0000564cb494e060 in main (argc=<optimized out>, argv=<optimized out>) at src/core/main.c:519 success = 1 manager = 0x564cb5d55060 config = <optimized out> error = 0x0 wrote_pidfile = 0 bad_domains = 0x0 config_cli = 0x0 sd_id = 148 error_invalid_logging_config = 0x0 warnings = <optimized out> errsv = <optimized out> __func__ = "main" Version-Release number of selected component (if applicable): NetworkManager-1.33.1-28603.copr.161cf11cb1.el8.x86_64 How reproducible: in centos main always Steps to Reproduce: 1. run/./runtest.sh nmcli_reconnect_openvswitch_vlan_configuration ;run/./runtest.sh NM_reboot_openvswitch_vlan_configuration; run/./runtest.sh ovs_cloned_mac_set_on_iface Actual results: the last one crashes Expected results: Additional info:
should be fixed by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/bbfdbf5f76ac0cdb85c9ccb5361bbfd8a0168e93. Note that I was not able to reproduce this with the mentioned steps. Maybe I did something wrong...
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: NetworkManager security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4361