Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2112997

Summary: Segmentation Fault in _nm_client_notify_event_queue_emit_obj_signal (libnm.so)
Product: Red Hat Enterprise Linux 8 Reporter: eraviv
Component: NetworkManagerAssignee: NetworkManager Development Team <nm-team>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Desktop QE <desktop-qa-list>
Severity: low Docs Contact:
Priority: low    
Version: CentOS StreamCC: bgalvani, bstinson, fge, jwboyer, lrintel, mperina, msobczyk, rkhan, sfaye, sukulkar, thaller, till
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-11-16 13:16:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
core dump none

Description eraviv 2022-08-01 16:25:56 UTC
Created attachment 1900648 [details]
core dump

Description of problem:


Version-Release number of selected component (if applicable):
NetworkManager-config-server-1:1.39.10-1.el8.noarch
NetworkManager-ovs-1:1.39.10-1.el8.x86_64
glib-networking-2.56.1-1.1.el8.x86_64


How reproducible:
once

Steps to Reproduce:
1. apply desired state via nmstate. 
this entails numerous calls which are listed in the attached supervdsm.log

Actual results:
Destroy checkpoint call crashes the caller (vdsm) and produces the attached core dump. See attached supervdsm.log:
```
MainProcess|jsonrpc/4::DEBUG::2022-08-01 12:27:02,829::context::148::root::(register_async) Async action: Destroy checkpoint /org/freedesktop/NetworkManager/Checkpoint/7 started
```



Expected results:


Additional info:
nmstate-1.3.1-1.el8.x86_64

Comment 4 Thomas Haller 2022-08-09 13:42:40 UTC
package version: 1:1.39.10-1.el8

backtrace from the coredump:


#0  0x00007fe96825eda4 in _nm_client_notify_event_queue_emit_obj_signal (self=0x0, source=0x0, nmobj=0x7fe950028be0, is_added=0, prio_offset=7, signal_id=3)
    at src/libnm-client-impl/nm-client.c:900
#1  0x00007fe968258f0e in nml_dbus_property_ao_notify_changed_ao (pr_ao_data=pr_ao_data@entry=0x7fe954032c10, self=self@entry=0x0, is_added=is_added@entry=0)
    at src/libnm-client-impl/nm-client.c:1939
        pr_ao = <optimized out>
        vtable = <optimized out>
#2  0x00007fe968261d2d in nml_dbus_property_ao_clear (pr_ao=pr_ao@entry=0x7fe95001e560, self=self@entry=0x0) at src/libnm-client-impl/nm-client.c:2314
        pr_ao_data = 0x7fe954032c10
        changed_prop = 0
#3  0x00007fe968261d6c in nml_dbus_property_ao_clear_many (pr_ao=0x7fe95001e5a8, pr_ao@entry=0x7fe95001e560, len=<optimized out>, len@entry=4, self=self@entry=0x0)
    at src/libnm-client-impl/nm-client.c:2357
#4  0x00007fe968266d26 in dispose (object=0x7fe95001e3d0) at src/libnm-client-impl/nm-client.c:7958
        self = 0x7fe95001e3d0
        priv = 0x7fe95001e400
#5  0x00007fe96ae76828 in g_object_unref () at /lib64/libgobject-2.0.so.0
...

Comment 5 Thomas Haller 2022-08-09 15:59:28 UTC
Can you reproduce this crash? Can I somehow reproduce this myself?

Comment 6 eraviv 2022-08-10 07:40:29 UTC
Hi Thomas,

Unfortunately we only saw this once in our automatic network tests suite. 
This suite runs ~24 times per day and run envs are rolled over every couple of hours or so.
So at the mo I can't provide any more info or a reproducing env, but if we come across this again I will ping you immediately.
Reproducing this manually would require running the suite, but they are constantly running anyway so monitoring the runs for this failure is the same imo because I do not see in the logs any specific action that could caused this failure.

HTH,
Eitan

Comment 7 sfaye 2022-11-16 13:16:08 UTC
Hi @eraviv, 

I am closing this as insufficient data for now as it is hard to investigate it. Please feel free to reopen it if you come across this again. 

Thanks