Bug 497051 - virsh detach-device ''Segmentation fault' error
virsh detach-device ''Segmentation fault' error
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: libvirt (Show other bugs)
5.4
All Linux
low Severity medium
: rc
: ---
Assigned To: Daniel Berrange
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-22 03:22 EDT by Alex Jia
Modified: 2009-12-14 16:17 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-02 05:22:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix resize of array (1.03 KB, patch)
2009-04-23 05:55 EDT, Daniel Berrange
no flags Details | Diff
Fix device count (822 bytes, patch)
2009-06-12 11:37 EDT, Daniel Berrange
no flags Details | Diff

  None (edit)
Description Alex Jia 2009-04-22 03:22:22 EDT
Description of problem:

It's right to attach disk block device from an xml,but detach the block device is failed.print error info "Segmentation fault" .

[root@dhcp-66-70-18 xml]# cat disk.xml
<disk type='block' device='disk'>
   <driver name='phy'/>
   <source dev='/var/lib/xen/images/add.img'/>
   <target dev='sda'/>
</disk>

[root@dhcp-66-70-18 xml]# virsh attach-device test disk.xml
Device attached successfully

[root@dhcp-66-70-18 xml]# virsh detach-device test disk.xml
Segmentation fault


Version-Release number of selected component (if applicable):
kernel:2.6.18-128.1.6.el5
libvirt-0.6.2-1.el5


How reproducible:
define a disk block device xml decripition,use virsh commands attach-device and detach-device to attach and destroy it.


Steps to Reproduce:
1.to create a disk images,e.g. dd if=/dev/zero of=add.img bs=1 count=1 seek=1G
2.to define disk block device xml
3.to run virsh attach-device and detach-device commands
  
Actual results:


Expected results:


Additional info:
Comment 1 Daniel Berrange 2009-04-22 04:57:38 EDT
Can you install the libvirt-debuginfo RPM and then run the command under GDB and valgrind, eg

  gdb --args  virsh detach-device test disk.xml

And then do a 'backtrace' when it crashes.

Also try and capture valgrind error logs just by running

  valgrind virsh detach-device test disk.xml


The combination of these two logs should quickly show where the problem lies
Comment 2 Alex Jia 2009-04-22 22:27:44 EDT
debug info as follow:

[root@dhcp-66-70-18 xml]# gdb --args virsh detach-device test disk.xml
GNU gdb Fedora (6.8-27.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) backtrace
No stack.
(gdb) list
7345
7346            free(cmdstr);
7347            return ret;
7348        }
7349        return TRUE;
7350    }
7351
7352    int
7353    main(int argc, char **argv)
7354    {



[root@dhcp-66-70-18 xml]# cat disk.xml
<disk type='block' device='disk'>
   <driver name='phy'/>
   <source dev='/var/lib/xen/images/add.img'/>
   <target dev='sda'/>

[root@dhcp-66-70-18 xml]# virsh attach-device test disk.xml 
Device attached successfully

[root@dhcp-66-70-18 xml]# virsh dumpxml test
domain 'test' device xml fragment:
  <devices>
    <emulator>/usr/lib64/xen/bin/qemu-dm</emulator>
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/var/lib/xen/images/test.img'/>
      <target dev='hda' bus='ide'/>
    </disk>
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <source dev='/var/lib/xen/images/add.img'/>
      <target dev='sda' bus='scsi'/>
    </disk>
  </devices>



[root@dhcp-66-70-18 xml]# valgrind virsh detach-device test disk.xml 
==5876== Memcheck, a memory error detector.
==5876== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==5876== Using LibVEX rev 1658, a library for dynamic binary translation.
==5876== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==5876== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==5876== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==5876== For more details, rerun with: -v
==5876== 
==5876== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==5876==    This could cause spurious value errors to appear.
==5876==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==5876== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==5876==    This could cause spurious value errors to appear.
==5876==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==5876== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==5876==    This could cause spurious value errors to appear.
==5876==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==5876== Invalid read of size 4
==5876==    at 0x3459C6C6C4: xenXMDomainConfigFormat (xm_internal.c:2394)
==5876==    by 0x3459C6D992: xenXMConfigSaveFile (xm_internal.c:341)
==5876==    by 0x3459C6F637: xenXMDomainDetachDevice (xm_internal.c:2947)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876==  Address 0x4C803EC is 4 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C6C6DA: xenXMDomainConfigFormat (xm_internal.c:1907)
==5876==    by 0x3459C6D992: xenXMConfigSaveFile (xm_internal.c:341)
==5876==    by 0x3459C6F637: xenXMDomainDetachDevice (xm_internal.c:2947)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876==  Address 0x4C803F8 is 16 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C6C7DB: xenXMDomainConfigFormat (xm_internal.c:1923)
==5876==    by 0x3459C6D992: xenXMConfigSaveFile (xm_internal.c:341)
==5876==    by 0x3459C6F637: xenXMDomainDetachDevice (xm_internal.c:2947)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876==  Address 0x4C80400 is 24 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 4
==5876==    at 0x3459C6C7F2: xenXMDomainConfigFormat (xm_internal.c:1924)
==5876==    by 0x3459C6D992: xenXMConfigSaveFile (xm_internal.c:341)
==5876==    by 0x3459C6F637: xenXMDomainDetachDevice (xm_internal.c:2947)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876==  Address 0x4C803EC is 4 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 1
==5876==    at 0x3459C6C7FC: xenXMDomainConfigFormat (xm_internal.c:1927)
==5876==    by 0x3459C6D992: xenXMConfigSaveFile (xm_internal.c:341)
==5876==    by 0x3459C6F637: xenXMDomainDetachDevice (xm_internal.c:2947)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876==  Address 0x4C8041C is 52 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
Device detached successfully

==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C18424: virFree (memory.c:177)
==5876==    by 0x3459C2E755: virDomainDiskDefFree (domain_conf.c:264)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C803F8 is 16 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid write of size 8
==5876==    at 0x3459C1842C: virFree (memory.c:178)
==5876==    by 0x3459C2E755: virDomainDiskDefFree (domain_conf.c:264)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C803F8 is 16 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C18424: virFree (memory.c:177)
==5876==    by 0x3459C2E762: virDomainDiskDefFree (domain_conf.c:265)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80400 is 24 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid write of size 8
==5876==    at 0x3459C1842C: virFree (memory.c:178)
==5876==    by 0x3459C2E762: virDomainDiskDefFree (domain_conf.c:265)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80400 is 24 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C18424: virFree (memory.c:177)
==5876==    by 0x3459C2E76F: virDomainDiskDefFree (domain_conf.c:266)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80408 is 32 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid write of size 8
==5876==    at 0x3459C1842C: virFree (memory.c:178)
==5876==    by 0x3459C2E76F: virDomainDiskDefFree (domain_conf.c:266)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80408 is 32 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid read of size 8
==5876==    at 0x3459C18424: virFree (memory.c:177)
==5876==    by 0x3459C2E77C: virDomainDiskDefFree (domain_conf.c:267)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80410 is 40 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid write of size 8
==5876==    at 0x3459C1842C: virFree (memory.c:178)
==5876==    by 0x3459C2E77C: virDomainDiskDefFree (domain_conf.c:267)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C80410 is 40 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== Invalid free() / delete / delete[]
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C2E927: virDomainDefFree (domain_conf.c:417)
==5876==    by 0x3459C6BFD4: xenXMConfigFree (xm_internal.c:294)
==5876==    by 0x3459C15DDB: virHashFree (hash.c:225)
==5876==    by 0x3459C6ED05: xenXMClose (xm_internal.c:613)
==5876==    by 0x3459C5F73B: xenUnifiedClose (xen_unified.c:400)
==5876==    by 0x3459C2B11C: virConnectClose (libvirt.c:1122)
==5876==    by 0x405CBE: vshDeinit (virsh.c:7182)
==5876==    by 0x410F70: main (virsh.c:7429)
==5876==  Address 0x4C803E8 is 0 bytes inside a block of size 64 free'd
==5876==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==5876==    by 0x3459C1842B: virFree (memory.c:177)
==5876==    by 0x3459C2E784: virDomainDiskDefFree (domain_conf.c:269)
==5876==    by 0x3459C6F654: xenXMDomainDetachDevice (xm_internal.c:2911)
==5876==    by 0x3459C5E111: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==5876==    by 0x3459C26FDF: virDomainDetachDevice (libvirt.c:4311)
==5876==    by 0x40A769: cmdDetachDevice (virsh.c:5043)
==5876==    by 0x4107ED: vshCommandRun (virsh.c:6444)
==5876==    by 0x411126: main (virsh.c:7396)
==5876== 
==5876== ERROR SUMMARY: 14 errors from 14 contexts (suppressed: 4 from 1)
==5876== malloc/free: in use at exit: 103,124 bytes in 771 blocks.
==5876== malloc/free: 2,458 allocs, 1,688 frees, 1,313,683 bytes allocated.
==5876== For counts of detected errors, rerun with: -v
==5876== searching for pointers to 771 not-freed blocks.
==5876== checked 811,176 bytes.
==5876== 
==5876== LEAK SUMMARY:
==5876==    definitely lost: 40 bytes in 1 blocks.
==5876==      possibly lost: 0 bytes in 0 blocks.
==5876==    still reachable: 103,084 bytes in 770 blocks.
==5876==         suppressed: 0 bytes in 0 blocks.
==5876== Use --leak-check=full to see details of leaked memory.



[root@dhcp-66-70-18 xml]# virsh dumpxml test
domain 'test' device xml fragment:
  <devices>
    <emulator>/usr/lib64/xen/bin/qemu-dm</emulator>
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <target dev='(null)' bus='ide'/>
    </disk>
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/var/lib/xen/images/test.img'/>
      <target dev='hda' bus='ide'/>
    </disk>
  </devices>
Comment 3 Daniel Berrange 2009-04-23 05:55:47 EDT
Created attachment 340918 [details]
Fix resize of array

It looks like when we're resizing the array containing the list of disk/network interfaces, we don't move the correct amount of memory. We're moving 'n' bytes, instead of 'sizeof(device)*n'  bytes
Comment 4 Alex Jia 2009-05-31 22:00:01 EDT
the problem is still existent on rhle5.4-Server,when detaching disk device,prompt "Segmentation fault".

[root@dhcp-66-70-18 images]# cat disk.xml 
<disk type='block' device='disk'>
   <driver name='phy'/>
   <source dev='/var/lib/xen/images/add.img'/>
   <target dev='sda'/>
</disk>

[root@dhcp-66-70-18 images]# virsh list --all
 Id Name                 State
----------------------------------
  0 Domain-0             running
  - rhel5-xenfv          shut off
  - rhel5-xenfv-clone    shut off

attach disk device to rhel5-xenfv-clone
[root@dhcp-66-70-18 images]# virsh attach-device rhel5-xenfv-clone disk.xml 
Device attached successfully

a part of dumping guest xml  
[root@dhcp-66-70-18 images]# virsh dumpxml rhel5-xenfv-clone
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/tmp/rhel5-xenfv-clone'/>
      <target dev='hda' bus='ide'/>
    </disk>
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <source dev='/var/lib/xen/images/add.img'/>
      <target dev='sda' bus='scsi'/>
    </disk>

detach disk device from rhel5-xenfv-clone
[root@dhcp-66-70-18 images]# virsh detach-device rhel5-xenfv-clone disk.xml
Device detached successfully

Segmentation fault


a part of dumping guest xml 
[root@dhcp-66-70-18 images]# virsh dumpxml rhel5-xenfv-clone
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <target dev='(null)' bus='ide'/>
    </disk>
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/tmp/rhel5-xenfv-clone'/>
      <target dev='hda' bus='ide'/>
    </disk>



host machine info:
[root@dhcp-66-70-18 site-packages]# uname -r
2.6.18-151.el5xen
[root@dhcp-66-70-18 site-packages]# rpm -qa|grep libvirt
libvirt-python-0.6.3-3.el5
libvirt-0.6.3-3.el5
libvirt-0.6.3-3.el5
Comment 5 Daniel Veillard 2009-06-04 09:57:48 EDT
Patch commited upstream, 

Daniel
Comment 6 Daniel Veillard 2009-06-04 12:43:07 EDT
libvirt-0.6.3-5.el5 has been built in dist-5E-qu-candidate with the fix,

Daniel
Comment 8 Alex Jia 2009-06-04 22:20:33 EDT
I verify the bug again,and when detaching the disk device,"Segmentation fault" information hasn't be displayed,but current system don't boot,details as follow:

[root@dhcp-66-70-18 ~]# virsh attach-device rhel5-xenfv disk.xml 
Device attached successfully

[root@dhcp-66-70-18 ~]# virsh dumpxml rhel5-xenfv
     <disk type='file' device='disk'>
       <driver name='file'/>
       <source file='/var/lib/libvirt/images/rhel5-xenfv'/>
       <target dev='hda' bus='ide'/>
     </disk>
     <disk type='block' device='disk'>
       <driver name='phy'/>
       <source dev='/var/lib/xen/images/add.img'/>
       <target dev='sda' bus='scsi'/>
     </disk>

[root@dhcp-66-70-18 ~]# virsh detach-device rhel5-xenfv disk.xml 
Device detached successfully

[root@dhcp-66-70-18 ~]# virsh dumpxml rhel5-xenfv
     <disk type='block' device='disk'>
       <driver name='phy'/>
       <target dev='' bus='ide'/>
     </disk>
     <disk type='file' device='disk'>
       <driver name='file'/>
       <source file='/var/lib/libvirt/images/rhel5-xenfv'/>
       <target dev='hda' bus='ide'/>
     </disk>

[root@dhcp-66-70-18 ~]# virsh start rhel5-xenfv
error: Failed to start domain rhel5-xenfv
error: POST operation failed: xend_post: error from xen daemon: (xend.err 'Error creating domain: Block device must have physical details specified')

[root@dhcp-66-70-18 ~]# virsh list --all
  Id Name                 State
 ----------------------------------
   0 Domain-0             running
   - rhel5-xenfv          shut off
   - test                 shut off
   - winxp                shut off

The causes of the problem is in domain xml Configuration,attach disk block tag need be delete from domain.xml(e.g rhel5-xenfv.xml) ,and need to define the domain again.

I try to delete the attach disk block tag,and define the domain again and start it,the result is right:)
Comment 9 Daniel Veillard 2009-06-05 15:05:59 EDT
w.r.t. comment 8, well the original bug is fixed.
Now you may have found another bug but IMHO it should be separated.
That's no morea crasher, the risks are lower.

Daniel
Comment 10 Alex Jia 2009-06-12 09:03:32 EDT
it still prompt information "Segmentation fault",but attaching the device has been deleted successfully.some libvirt debug info as follow:


[root@dhcp-66-70-18 images]# virsh detach-device guest1 disk.xml 
20:58:59.997: debug : virInitialize:290 : register drivers
20:58:59.997: debug : virRegisterDriver:667 : registering Test as driver 0
20:58:59.997: debug : virRegisterNetworkDriver:567 : registering Test as network driver 0
20:58:59.997: debug : virRegisterStorageDriver:598 : registering Test as storage driver 0
20:58:59.997: debug : virRegisterDeviceMonitor:629 : registering Test as device driver 0
20:58:59.997: debug : xenHypervisorInit:1922 : Using new hypervisor call: 30001

20:58:59.997: debug : xenHypervisorInit:1991 : Using hypervisor call v2, sys ver3 dom ver5

20:58:59.997: debug : virRegisterDriver:667 : registering Xen as driver 1
20:58:59.997: debug : virRegisterDriver:667 : registering remote as driver 2
20:58:59.997: debug : virRegisterNetworkDriver:567 : registering remote as network driver 1
20:58:59.997: debug : virRegisterStorageDriver:598 : registering remote as storage driver 1
20:58:59.997: debug : virRegisterDeviceMonitor:629 : registering remote as device driver 1
20:58:59.997: debug : virConnectOpenAuth:1100 : name=(null), auth=0x2b1aa7bb6380, flags=0
20:58:59.997: debug : do_open:922 : no name, allowing driver auto-select
20:58:59.997: debug : do_open:930 : trying driver 0 (Test) ...
20:58:59.997: debug : do_open:936 : driver 0 Test returned DECLINED
20:58:59.997: debug : do_open:930 : trying driver 1 (Xen) ...
20:58:59.998: debug : xenUnifiedOpen:295 : Trying hypervisor sub-driver
20:58:59.998: debug : xenUnifiedOpen:298 : Activated hypervisor sub-driver
20:58:59.998: debug : xenUnifiedOpen:306 : Trying XenD sub-driver
20:58:59.999: debug : xenUnifiedOpen:309 : Activated XenD sub-driver
20:58:59.999: debug : xenUnifiedOpen:315 : Trying XM sub-driver
20:58:59.999: debug : xenUnifiedOpen:318 : Activated XM sub-driver
20:58:59.999: debug : xenUnifiedOpen:322 : Trying XS sub-driver
20:58:59.999: debug : xenStoreOpen:346 : Failed to add event handle, disabling events

20:58:59.999: debug : xenUnifiedOpen:325 : Activated XS sub-driver
20:59:00.006: debug : xenUnifiedOpen:361 : Trying Xen inotify sub-driver
20:59:00.006: debug : xenInotifyOpen:439 : Adding a watch on /etc/xen
20:59:00.006: debug : xenInotifyOpen:451 : Building initial config cache
20:59:00.006: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/winxp
20:59:00.006: debug : xenXMConfigCacheAddFile:465 : Added config winxp /etc/xen/winxp
20:59:00.006: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/guest
20:59:00.006: debug : xenXMConfigCacheAddFile:465 : Added config guest /etc/xen/guest
20:59:00.006: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/guest1
20:59:00.007: debug : xenXMConfigCacheAddFile:465 : Added config guest1 /etc/xen/guest1
20:59:00.007: debug : xenInotifyOpen:458 : Registering with event loop
20:59:00.007: debug : xenInotifyOpen:462 : Failed to add inotify handle, disabling events
20:59:00.007: debug : virConnectRef:1165 : conn=0x10fd2f10 refs=3
20:59:00.007: debug : xenUnifiedOpen:364 : Activated Xen inotify sub-driver
20:59:00.007: debug : do_open:936 : driver 1 Xen returned SUCCESS
20:59:00.007: debug : do_open:956 : network driver 0 Test returned DECLINED
20:59:00.007: debug : doRemoteOpen:513 : proceeding with name = xen:///
20:59:00.007: debug : call:6545 : Doing call 66 (nil)
20:59:00.007: debug : call:6615 : We have the buck 66 0x2aaaaaaf1010 0x2aaaaaaf1010
20:59:00.007: debug : processCallRecvLen:6203 : Got length, now need 36 total (32 more)
20:59:00.007: debug : processCalls:6471 : Giving up the buck 66 0x2aaaaaaf1010 (nil)
20:59:00.007: debug : call:6646 : All done with our call 66 (nil) 0x2aaaaaaf1010
20:59:00.007: debug : call:6545 : Doing call 1 (nil)
20:59:00.007: debug : call:6615 : We have the buck 1 0x10fff8e0 0x10fff8e0
20:59:00.038: debug : processCallRecvLen:6203 : Got length, now need 28 total (24 more)
20:59:00.038: debug : processCalls:6471 : Giving up the buck 1 0x10fff8e0 (nil)
20:59:00.038: debug : call:6646 : All done with our call 1 (nil) 0x10fff8e0
20:59:00.038: debug : doRemoteOpen:824 : Adding Handler for remote events
20:59:00.039: debug : doRemoteOpen:831 : virEventAddHandle failed: No addHandleImpl defined. continuing without events.
20:59:00.039: debug : do_open:956 : network driver 1 remote returned SUCCESS
20:59:00.039: debug : do_open:978 : storage driver 0 Test returned DECLINED
20:59:00.039: debug : do_open:978 : storage driver 1 remote returned SUCCESS
20:59:00.039: debug : do_open:999 : node driver 0 Test returned DECLINED
20:59:00.039: debug : do_open:999 : node driver 1 remote returned SUCCESS
20:59:00.039: debug : virDomainLookupByName:1718 : conn=0x10fd2f10, name=guest1
20:59:00.041: debug : virGetDomain:271 : New hash entry 0x10ff3f20
20:59:00.042: debug : virDomainDetachDevice:4313 : domain=0x10ff3f20, xml=<disk type='block' device='disk'>
  <driver name='phy'/>
  <source dev='/var/lib/xen/images/add.img'/>
  <target dev='sda'/>
</disk>

Device detached successfully
20:59:00.042: debug : virDomainFree:1806 : domain=0x10ff3f20
20:59:00.042: debug : virUnrefDomain:345 : unref domain 0x10ff3f20 guest1 1
20:59:00.042: debug : virReleaseDomain:303 : release domain 0x10ff3f20 guest1
20:59:00.042: debug : virReleaseDomain:315 : unref connection 0x10fd2f10 5

20:59:00.042: debug : virConnectClose:1118 : conn=0x10fd2f10
20:59:00.042: debug : call:6545 : Doing call 2 (nil)
20:59:00.043: debug : call:6615 : We have the buck 2 0x10fff8e0 0x10fff8e0
20:59:00.043: debug : processCallRecvLen:6203 : Got length, now need 28 total (24 more)
20:59:00.043: debug : processCalls:6471 : Giving up the buck 2 0x10fff8e0 (nil)
20:59:00.043: debug : call:6646 : All done with our call 2 (nil) 0x10fff8e0
20:59:00.043: debug : virUnrefConnect:210 : unref connection 0x10fd2f10 4
20:59:00.043: debug : virUnrefConnect:210 : unref connection 0x10fd2f10 3
Segmentation fault
Comment 11 Daniel Berrange 2009-06-12 09:11:07 EDT
Can you tell me what libvirt RPM version you are now using ?  Also can you reproduce the crash when running virsh under either 'valgrind' or 'gdb'
Comment 12 Alex Jia 2009-06-12 09:15:20 EDT
dump domain disk xml part after detaching:

    <disk type='block' device='disk'>
      <driver name='phy'/>
      <target dev='file' bus='ide'/>
    </disk>
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/var/lib/xen/images/virtimage'/>
      <target dev='hda' bus='ide'/>
    </disk>

[root@dhcp-66-70-18 images]# uname -a
Linux dhcp-66-70-18.nay.redhat.com 2.6.18-151.el5xen #1 SMP Wed May 27 16:33:19 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[root@dhcp-66-70-18 images]# rpm -qa|grep libvirt
libvirt-debuginfo-0.6.3-8.el5
libvirt-0.6.3-8.el5
libvirt-cim-0.5.5-1.el5
libvirt-0.6.3-6.el5
libvirt-devel-0.6.3-8.el5
libvirt-python-0.6.3-8.el5
Comment 13 Alex Jia 2009-06-12 09:24:09 EDT
guest1 virt-type:xenfv

[root@dhcp-66-70-18 images]# virsh attach-device guest1 disk.xml 
Device attached successfully

[root@dhcp-66-70-18 images]# virsh dumpxml guest1
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/var/lib/xen/images/virtimage'/>
      <target dev='hda' bus='ide'/>
    </disk>
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <source dev='/var/lib/xen/images/add.img'/>
      <target dev='sda' bus='scsi'/>
    </disk>

[root@dhcp-66-70-18 images]# valgrind virsh detach-device guest1 disk.xml 
==15078== Memcheck, a memory error detector.
==15078== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==15078== Using LibVEX rev 1658, a library for dynamic binary translation.
==15078== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==15078== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==15078== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==15078== For more details, rerun with: -v
==15078== 
==15078== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==15078==    This could cause spurious value errors to appear.
==15078==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==15078== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==15078==    This could cause spurious value errors to appear.
==15078==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==15078== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==15078==    This could cause spurious value errors to appear.
==15078==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==15078== Invalid read of size 4
==15078==    at 0x4C9636A: xenXMDomainConfigFormat (xm_internal.c:2416)
==15078==    by 0x4C97742: xenXMConfigSaveFile (xm_internal.c:341)
==15078==    by 0x4C993D7: xenXMDomainDetachDevice (xm_internal.c:2971)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078==  Address 0x51496C4 is 4 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C96380: xenXMDomainConfigFormat (xm_internal.c:1908)
==15078==    by 0x4C97742: xenXMConfigSaveFile (xm_internal.c:341)
==15078==    by 0x4C993D7: xenXMDomainDetachDevice (xm_internal.c:2971)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078==  Address 0x51496D0 is 16 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C96481: xenXMDomainConfigFormat (xm_internal.c:1924)
==15078==    by 0x4C97742: xenXMConfigSaveFile (xm_internal.c:341)
==15078==    by 0x4C993D7: xenXMDomainDetachDevice (xm_internal.c:2971)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078==  Address 0x51496D8 is 24 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 4
==15078==    at 0x4C96498: xenXMDomainConfigFormat (xm_internal.c:1925)
==15078==    by 0x4C97742: xenXMConfigSaveFile (xm_internal.c:341)
==15078==    by 0x4C993D7: xenXMDomainDetachDevice (xm_internal.c:2971)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078==  Address 0x51496C4 is 4 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 1
==15078==    at 0x4C964A2: xenXMDomainConfigFormat (xm_internal.c:1928)
==15078==    by 0x4C97742: xenXMConfigSaveFile (xm_internal.c:341)
==15078==    by 0x4C993D7: xenXMDomainDetachDevice (xm_internal.c:2971)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078==  Address 0x51496F4 is 52 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
Device detached successfully

==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C41654: virFree (memory.c:177)
==15078==    by 0x4C57C65: virDomainDiskDefFree (domain_conf.c:265)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496D0 is 16 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid write of size 8
==15078==    at 0x4C4165C: virFree (memory.c:178)
==15078==    by 0x4C57C65: virDomainDiskDefFree (domain_conf.c:265)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496D0 is 16 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C41654: virFree (memory.c:177)
==15078==    by 0x4C57C72: virDomainDiskDefFree (domain_conf.c:266)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496D8 is 24 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid write of size 8
==15078==    at 0x4C4165C: virFree (memory.c:178)
==15078==    by 0x4C57C72: virDomainDiskDefFree (domain_conf.c:266)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496D8 is 24 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C41654: virFree (memory.c:177)
==15078==    by 0x4C57C7F: virDomainDiskDefFree (domain_conf.c:267)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496E0 is 32 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid write of size 8
==15078==    at 0x4C4165C: virFree (memory.c:178)
==15078==    by 0x4C57C7F: virDomainDiskDefFree (domain_conf.c:267)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496E0 is 32 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid read of size 8
==15078==    at 0x4C41654: virFree (memory.c:177)
==15078==    by 0x4C57C8C: virDomainDiskDefFree (domain_conf.c:268)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496E8 is 40 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid write of size 8
==15078==    at 0x4C4165C: virFree (memory.c:178)
==15078==    by 0x4C57C8C: virDomainDiskDefFree (domain_conf.c:268)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496E8 is 40 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== Invalid free() / delete / delete[]
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C57E35: virDomainDefFree (domain_conf.c:418)
==15078==    by 0x4C95C74: xenXMConfigFree (xm_internal.c:294)
==15078==    by 0x4C3F00B: virHashFree (hash.c:225)
==15078==    by 0x4C98AA5: xenXMClose (xm_internal.c:613)
==15078==    by 0x4C8945B: xenUnifiedClose (xen_unified.c:400)
==15078==    by 0x4C5455C: virConnectClose (libvirt.c:1133)
==15078==    by 0x405DDE: vshDeinit (virsh.c:7287)
==15078==    by 0x4112DD: main (virsh.c:7534)
==15078==  Address 0x51496C0 is 0 bytes inside a block of size 64 free'd
==15078==    at 0x4A0541E: free (vg_replace_malloc.c:233)
==15078==    by 0x4C4165B: virFree (memory.c:177)
==15078==    by 0x4C57C94: virDomainDiskDefFree (domain_conf.c:270)
==15078==    by 0x4C993F4: xenXMDomainDetachDevice (xm_internal.c:2933)
==15078==    by 0x4C87E31: xenUnifiedDomainDetachDevice (xen_unified.c:1195)
==15078==    by 0x4C5041F: virDomainDetachDevice (libvirt.c:4329)
==15078==    by 0x40A899: cmdDetachDevice (virsh.c:5145)
==15078==    by 0x410BAB: vshCommandRun (virsh.c:6548)
==15078==    by 0x411493: main (virsh.c:7501)
==15078== 
==15078== ERROR SUMMARY: 14 errors from 14 contexts (suppressed: 4 from 1)
==15078== malloc/free: in use at exit: 103,134 bytes in 771 blocks.
==15078== malloc/free: 2,671 allocs, 1,901 frees, 1,373,811 bytes allocated.
==15078== For counts of detected errors, rerun with: -v
==15078== searching for pointers to 771 not-freed blocks.
==15078== checked 794,832 bytes.
==15078== 
==15078== LEAK SUMMARY:
==15078==    definitely lost: 40 bytes in 1 blocks.
==15078==      possibly lost: 0 bytes in 0 blocks.
==15078==    still reachable: 103,094 bytes in 770 blocks.
==15078==         suppressed: 0 bytes in 0 blocks.
==15078== Use --leak-check=full to see details of leaked memory.

[root@dhcp-66-70-18 images]# virsh dumpxml guest1
    <disk type='block' device='disk'>
      <driver name='phy'/>
      <target dev='(null)' bus='ide'/>
    </disk>
    <disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/var/lib/xen/images/virtimage'/>
      <target dev='hda' bus='ide'/>
    </disk>
Comment 14 Daniel Berrange 2009-06-12 11:37:29 EDT
Created attachment 347594 [details]
Fix device count

This is a comedy of errors. The original code also didn't remember to decrement the number of devices after deleting it.
Comment 15 Daniel Veillard 2009-06-15 12:34:18 EDT
Dohhhh !

libvirt-0.6.3-10.el5 has been built in dist-5E-qu-candidate with the second
patch added, hopefully that's fine now !

Daniel
Comment 16 Alex Jia 2009-06-16 01:58:55 EDT
the issue has been resolved,and this is fine now.
Comment 17 Alex Jia 2009-07-20 21:52:03 EDT
This bug has been verified with libvirt 0.6.3-10.el5 on RHEL-Server-5.4(2.6.18-151.el5xen). Already fixed, set status to VERIFIED.
Comment 19 errata-xmlrpc 2009-09-02 05:22:28 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2009-1269.html

Note You need to log in before you can comment on or make changes to this bug.