Bug 504285 - destroy node device and create node device from xml has "Segmentation fault"
destroy node device and create node device from xml has "Segmentation fault"
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: libvirt (Show other bugs)
5.4
All Linux
medium Severity medium
: rc
: ---
Assigned To: Daniel Berrange
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-06-05 08:50 EDT by Alex Jia
Modified: 2009-12-14 16:09 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-02 05:21:33 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix incorrect use of private data field (1.91 KB, patch)
2009-06-09 13:09 EDT, Daniel Berrange
no flags Details | Diff

  None (edit)
Description Alex Jia 2009-06-05 08:50:58 EDT
Description of problem:
when destroying a node device on host machine,prompting "Segmentation fault".and when creating a node device from xml,the result is the same 

Version-Release number of selected component (if applicable):
[root@dhcp-66-70-18 libvirt]# uname -r
2.6.18-151.el5xen

[root@dhcp-66-70-18 libvirt]# rpm -qa|grep libvirt
libvirt-python-0.6.3-5.el5
libvirt-cim-0.5.5-1.el5
libvirt-0.6.3-5.el5
libvirt-debuginfo-0.6.3-5.el5
libvirt-devel-0.6.3-5.el5

How reproducible:
[root@dhcp-66-70-18 libvirt]# virsh nodeinfo
CPU model:           x86_64
CPU(s):              2
CPU frequency:       2992 MHz
CPU socket(s):       1
Core(s) per socket:  2
Thread(s) per core:  1
NUMA cell(s):        1
Memory size:         8254464 kB

[root@dhcp-66-70-18 libvirt]# virsh nodedev-list
computer
...
pci_8086_29b7
storage_model_DVD__RW_DH_16A6S
...
[root@dhcp-66-70-18 libvirt]# virsh nodedev-dumpxml storage_model_DVD__RW_DH_16A6S
<device>
  <name>storage_model_DVD__RW_DH_16A6S</name>
  <parent>pci_8086_2922_scsi_host_3_scsi_device_lun0</parent>
  <capability type='storage'>
    <block>/dev/scd0</block>
    <bus>scsi</bus>
    <drive_type>cdrom</drive_type>
    <model>DVD+-RW DH-16A6S</model>
    <vendor>PLDS</vendor>
    <capability type='removable'>
      <media_available>0</media_available>
      <media_size>0</media_size>
    </capability>
  </capability>
</device>

[root@dhcp-66-70-18 libvirt]# python
Python 2.4.3 (#1, Sep 17 2008, 16:07:08) 
[GCC 4.1.2 20071124 (Red Hat 4.1.2-41)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import libvirt
>>> conn=libvirt.open(None)

>>> dev=conn.nodeDeviceLookupByName("storage_model_DVD__RW_DH_16A6S")
>>> dir(dev)
['XMLDesc', '__del__', '__doc__', '__init__', '__module__', '_conn', '_o', 'destroy', 'dettach', 'listCaps', 'name', 'numOfCaps', 'parent', 'reAttach', 'ref', 'reset']
>>> dev.name()
'storage_model_DVD__RW_DH_16A6S'
>>> dev.listCaps()
['storage']
>>> dev.numOfCaps()
1
>>> dev.parent()
'pci_8086_2922_scsi_host_3_scsi_device_lun0'
>>> dev.destroy()
Segmentation fault

------------------------
and when creating the node device from xml by virsh commands,the result is the same to destroying node device.but importing libvirt module to python:


>>> dev.XMLDesc(0)
"<device>\n  <name>storage_model_DVD__RW_DH_16A6S</name>\n  <parent>pci_8086_2922_scsi_host_3_scsi_device_lun0</parent>\n  <capability type='storage'>\n    <block>/dev/scd0</block>\n    <bus>scsi</bus>\n    <drive_type>cdrom</drive_type>\n    <model>DVD+-RW DH-16A6S</model>\n    <vendor>PLDS</vendor>\n    <capability type='removable'>\n      <media_available>0</media_available>\n      <media_size>0</media_size>\n    </capability>\n  </capability>\n</device>\n"

>>> devxml=dev.XMLDesc(0)
>>> conn.createXML(devxml,0)
libvir: Domain Config error : internal error incorrect root element
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/usr/lib64/python2.4/site-packages/libvirt.py", line 994, in createXML
    if ret is None:raise libvirtError('virDomainCreateXML() failed', conn=self)
libvirt.libvirtError: internal error incorrect root element


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

when creating node device from xml,the failed reasons may be named error in libvirt.py,because domain and node use the same name createXML in class VirConnect.
Comment 1 Daniel Berrange 2009-06-08 08:37:42 EDT
One problem per bug report please. File another bug if you have a problem with 
device creation, and let this bug focus on the SEGV problem.


For the SEGV fault upon dev.destroy(), can you install the 'python-debuginfo' and 'libvirt-debuginfo' RPM, and then run python under gdb, eg run

  # gdb python
  >>> import libvirt
  >>> conn=libvirt.open(None) 
  >>> dev=conn.nodeDeviceLookupByName("storage_model_DVD__RW_DH_16A6S")
  >>> dev.destroy()


And then when it crashes, type 'backtrace' in GDB to get a full trace
Comment 2 Alex Jia 2009-06-08 23:39:44 EDT
start libvirt-debuginfo

[root@dhcp-66-70-18 ~]# export LIBVIRT_DEBUG=1
[root@dhcp-66-70-18 ~]# python
Python 2.4.3 (#1, Sep 17 2008, 16:07:08) 
[GCC 4.1.2 20071124 (Red Hat 4.1.2-41)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import libvirt
09:59:28.112: debug : virInitialize:290 : register drivers
09:59:28.112: debug : virRegisterDriver:667 : registering Test as driver 0
09:59:28.112: debug : virRegisterNetworkDriver:567 : registering Test as network driver 0
09:59:28.112: debug : virRegisterStorageDriver:598 : registering Test as storage driver 0
09:59:28.112: debug : virRegisterDeviceMonitor:629 : registering Test as device driver 0
09:59:28.112: debug : xenHypervisorInit:1922 : Using new hypervisor call: 30001

09:59:28.112: debug : xenHypervisorInit:1991 : Using hypervisor call v2, sys ver3 dom ver5

09:59:28.112: debug : virRegisterDriver:667 : registering Xen as driver 1
09:59:28.112: debug : virRegisterDriver:667 : registering remote as driver 2
09:59:28.112: debug : virRegisterNetworkDriver:567 : registering remote as network driver 1
09:59:28.112: debug : virRegisterStorageDriver:598 : registering remote as storage driver 1
09:59:28.112: debug : virRegisterDeviceMonitor:629 : registering remote as device driver 1
>>> conn=libvirt.open(None)
09:59:48.002: debug : virConnectOpen:1050 : name=(null)
09:59:48.002: debug : do_open:922 : no name, allowing driver auto-select
09:59:48.002: debug : do_open:930 : trying driver 0 (Test) ...
09:59:48.002: debug : do_open:936 : driver 0 Test returned DECLINED
09:59:48.002: debug : do_open:930 : trying driver 1 (Xen) ...
09:59:48.002: debug : xenUnifiedOpen:295 : Trying hypervisor sub-driver
09:59:48.002: debug : xenUnifiedOpen:298 : Activated hypervisor sub-driver
09:59:48.002: debug : xenUnifiedOpen:306 : Trying XenD sub-driver
09:59:48.003: debug : xenUnifiedOpen:309 : Activated XenD sub-driver
09:59:48.003: debug : xenUnifiedOpen:315 : Trying XM sub-driver
09:59:48.003: debug : xenUnifiedOpen:318 : Activated XM sub-driver
09:59:48.003: debug : xenUnifiedOpen:322 : Trying XS sub-driver
09:59:48.003: debug : xenStoreOpen:346 : Failed to add event handle, disabling events

09:59:48.003: debug : xenUnifiedOpen:325 : Activated XS sub-driver
09:59:48.012: debug : xenUnifiedOpen:361 : Trying Xen inotify sub-driver
09:59:48.012: debug : xenInotifyOpen:439 : Adding a watch on /etc/xen
09:59:48.012: debug : xenInotifyOpen:451 : Building initial config cache
09:59:48.012: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/rhel5.3-xenfv-raw
09:59:48.012: debug : xenXMConfigCacheAddFile:465 : Added config rhel5.3-xenfv-raw /etc/xen/rhel5.3-xenfv-raw
09:59:48.012: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/winxp
09:59:48.012: debug : xenXMConfigCacheAddFile:465 : Added config winxp /etc/xen/winxp
09:59:48.012: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/rhel5-xenfv
09:59:48.012: debug : xenXMConfigCacheAddFile:465 : Added config rhel5-xenfv /etc/xen/rhel5-xenfv
09:59:48.012: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/rhel5.3-xenfv-qcow
09:59:48.012: debug : xenXMConfigCacheAddFile:465 : Added config rhel5.3-xenfv-qcow /etc/xen/rhel5.3-xenfv-qcow
09:59:48.012: debug : xenInotifyOpen:458 : Registering with event loop
09:59:48.012: debug : xenInotifyOpen:462 : Failed to add inotify handle, disabling events
09:59:48.012: debug : virConnectRef:1165 : conn=0x15b11420 refs=3
09:59:48.012: debug : xenUnifiedOpen:364 : Activated Xen inotify sub-driver
09:59:48.012: debug : do_open:936 : driver 1 Xen returned SUCCESS
09:59:48.012: debug : do_open:956 : network driver 0 Test returned DECLINED
09:59:48.012: debug : doRemoteOpen:511 : proceeding with name = xen:///
09:59:48.012: debug : call:6543 : Doing call 66 (nil)
09:59:48.012: debug : call:6613 : We have the buck 66 0x2aaaaaaf2010 0x2aaaaaaf2010
09:59:48.013: debug : processCallRecvLen:6201 : Got length, now need 36 total (32 more)
09:59:48.013: debug : processCalls:6469 : Giving up the buck 66 0x2aaaaaaf2010 (nil)
09:59:48.013: debug : call:6644 : All done with our call 66 (nil) 0x2aaaaaaf2010
09:59:48.013: debug : call:6543 : Doing call 1 (nil)
09:59:48.013: debug : call:6613 : We have the buck 1 0x15b587d0 0x15b587d0
09:59:48.026: debug : processCallRecvLen:6201 : Got length, now need 28 total (24 more)
09:59:48.026: debug : processCalls:6469 : Giving up the buck 1 0x15b587d0 (nil)
09:59:48.026: debug : call:6644 : All done with our call 1 (nil) 0x15b587d0
09:59:48.026: debug : doRemoteOpen:822 : Adding Handler for remote events
09:59:48.026: debug : doRemoteOpen:829 : virEventAddHandle failed: No addHandleImpl defined. continuing without events.
09:59:48.026: debug : do_open:956 : network driver 1 remote returned SUCCESS
09:59:48.026: debug : do_open:978 : storage driver 0 Test returned DECLINED
09:59:48.026: debug : do_open:978 : storage driver 1 remote returned SUCCESS
09:59:48.026: debug : do_open:999 : node driver 0 Test returned DECLINED
09:59:48.026: debug : do_open:999 : node driver 1 remote returned SUCCESS
>>> dev=conn.nodeDeviceLookupByName("storage_model_DVD__RW_DH_16A6S")
10:00:36.501: debug : virNodeDeviceLookupByName:7123 : conn=0x15b11420, name=0x2b5926606fcc
10:00:36.501: debug : call:6543 : Doing call 113 (nil)
10:00:36.501: debug : call:6613 : We have the buck 113 0x15b587d0 0x15b587d0
10:00:36.501: debug : processCallRecvLen:6201 : Got length, now need 64 total (60 more)
10:00:36.501: debug : processCalls:6469 : Giving up the buck 113 0x15b587d0 (nil)
10:00:36.501: debug : call:6644 : All done with our call 113 (nil) 0x15b587d0
>>> dir(dev)
['XMLDesc', '__del__', '__doc__', '__init__', '__module__', '_conn', '_o', 'destroy', 'dettach', 'listCaps', 'name', 'numOfCaps', 'parent', 'reAttach', 'ref', 'reset']
>>> dev.destroy()
10:01:01.270: debug : virNodeDeviceDestroy:7576 : dev=0x15b2f650
10:01:01.270: debug : call:6543 : Doing call 124 (nil)
10:01:01.270: debug : call:6613 : We have the buck 124 0x15b587d0 0x15b587d0
Segmentation fault

==============================================================================
start gdb

[root@dhcp-66-70-18 ~]#  gdb --args virsh nodedev-destroy storage_model_DVD__RW_DH_16A6S
GNU gdb Fedora (6.8-35.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) backtrace
No stack.
(gdb)

==============================================================================
start valgrind

[root@dhcp-66-70-18 ~]# valgrind virsh nodedev-destroy storage_model_DVD__RW_DH_16A6S
==4549== Memcheck, a memory error detector.
==4549== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==4549== Using LibVEX rev 1658, a library for dynamic binary translation.
==4549== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==4549== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==4549== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==4549== For more details, rerun with: -v
==4549==
==4549== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==4549==    This could cause spurious value errors to appear.
==4549==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==4549== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==4549==    This could cause spurious value errors to appear.
==4549==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==4549== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==4549==    This could cause spurious value errors to appear.
==4549==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x3979643A64: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Use of uninitialised value of size 8
==4549==    at 0x39796419E1: _itoa_word (in /lib64/libc-2.5.so)
==4549==    by 0x3979644E5A: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x39796419E8: _itoa_word (in /lib64/libc-2.5.so)
==4549==    by 0x3979644E5A: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x3979644ED4: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x3979643B2C: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x3979643B85: vfprintf (in /lib64/libc-2.5.so)
==4549==    by 0x39796E6D97: __vsnprintf_chk (in /lib64/libc-2.5.so)
==4549==    by 0x4C412A7: virLogMessage (logging.c:513)
==4549==    by 0x4C70B9B: call (remote_internal.c:6543)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Conditional jump or move depends on uninitialised value(s)
==4549==    at 0x4C70E01: call (remote_internal.c:6554)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Use of uninitialised value of size 8
==4549==    at 0x4C70E14: call (remote_internal.c:6558)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== Invalid read of size 8
==4549==    at 0x4C70E14: call (remote_internal.c:6558)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549==  Address 0x7FF03EF90 is not stack'd, malloc'd or (recently) free'd
==4549== 
==4549== Process terminating with default action of signal 11 (SIGSEGV)
==4549==  Access not within mapped region at address 0x7FF03EF90
==4549==    at 0x4C70E14: call (remote_internal.c:6558)
==4549==    by 0x4C71907: remoteNodeDeviceDestroy (remote_internal.c:5030)
==4549==    by 0x4C4CFD4: virNodeDeviceDestroy (libvirt.c:7592)
==4549==    by 0x40D0F3: cmdNodeDeviceDestroy (virsh.c:3053)
==4549==    by 0x410B3F: vshCommandRun (virsh.c:6548)
==4549==    by 0x411486: main (virsh.c:7500)
==4549== 
==4549== ERROR SUMMARY: 47 errors from 9 contexts (suppressed: 4 from 1)
==4549== malloc/free: in use at exit: 663,376 bytes in 986 blocks.
==4549== malloc/free: 2,930 allocs, 1,944 frees, 1,653,517 bytes allocated.
==4549== For counts of detected errors, rerun with: -v
==4549== searching for pointers to 986 not-freed blocks.
==4549== checked 11,819,328 bytes.
==4549== 
==4549== LEAK SUMMARY:
==4549==    definitely lost: 0 bytes in 0 blocks.
==4549==      possibly lost: 304 bytes in 1 blocks.
==4549==    still reachable: 663,072 bytes in 985 blocks.
==4549==         suppressed: 0 bytes in 0 blocks.
==4549== Reachable blocks (those to which a pointer was found) are not shown.
==4549== To see them, rerun with: --show-reachable=yes
Killed
Comment 3 Daniel Berrange 2009-06-09 13:09:43 EDT
Created attachment 347059 [details]
Fix incorrect use of private data field

The 2 new methods added for NPIV were using the wrong privateData field for the remote driver. This doesn't impact KVM, since the remote driver handles everything, thus privateData == devMonPrivateData. It does impact Xen though, because the remote driver only handles a subset of methods and thus privateData != devMonPrivateData.
Comment 7 Daniel Veillard 2009-06-15 08:57:15 EDT
libvirt-0.6.3-9.el5 has been built in dist-5E-qu-candidate with the fix,

Daniel
Comment 10 Alex Jia 2009-06-16 01:43:59 EDT
[root@dhcp-66-70-18 libvirt]# uname -a
Linux dhcp-66-70-18.nay.redhat.com 2.6.18-151.el5xen #1 SMP Wed May 27 16:33:19 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[root@dhcp-66-70-18 libvirt]# rpm -qa|grep libvirt
libvirt-devel-0.6.3-10.el5
libvirt-cim-0.5.5-1.el5
libvirt-0.6.3-10.el5
libvirt-debuginfo-0.6.3-10.el5
libvirt-python-0.6.3-10.el5
[root@dhcp-66-70-18 libvirt]# virsh nodedev-list
computer
net_00_23_ae_6f_f1_d7
pci_1002_94c3
...
storage_model_DVD__RW_DH_16A6S
...

[root@dhcp-66-70-18 libvirt]# export LIBVIRT_DEBUG=1
[root@dhcp-66-70-18 libvirt]# python
Python 2.4.3 (#1, Sep 17 2008, 16:07:08) 
[GCC 4.1.2 20071124 (Red Hat 4.1.2-41)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import libvirt
13:40:54.729: debug : virInitialize:290 : register drivers
13:40:54.729: debug : virRegisterDriver:667 : registering Test as driver 0
13:40:54.729: debug : virRegisterNetworkDriver:567 : registering Test as network driver 0
13:40:54.729: debug : virRegisterStorageDriver:598 : registering Test as storage driver 0
13:40:54.729: debug : virRegisterDeviceMonitor:629 : registering Test as device driver 0
13:40:54.729: debug : xenHypervisorInit:1922 : Using new hypervisor call: 30001

13:40:54.729: debug : xenHypervisorInit:1991 : Using hypervisor call v2, sys ver3 dom ver5

13:40:54.729: debug : virRegisterDriver:667 : registering Xen as driver 1
13:40:54.729: debug : virRegisterDriver:667 : registering remote as driver 2
13:40:54.729: debug : virRegisterNetworkDriver:567 : registering remote as network driver 1
13:40:54.729: debug : virRegisterStorageDriver:598 : registering remote as storage driver 1
13:40:54.729: debug : virRegisterDeviceMonitor:629 : registering remote as device driver 1
>>> conn=libvirt.open(None)
13:41:03.734: debug : virConnectOpen:1050 : name=(null)
13:41:03.734: debug : do_open:922 : no name, allowing driver auto-select
13:41:03.734: debug : do_open:930 : trying driver 0 (Test) ...
13:41:03.734: debug : do_open:936 : driver 0 Test returned DECLINED
13:41:03.734: debug : do_open:930 : trying driver 1 (Xen) ...
13:41:03.734: debug : xenUnifiedOpen:295 : Trying hypervisor sub-driver
13:41:03.734: debug : xenUnifiedOpen:298 : Activated hypervisor sub-driver
13:41:03.734: debug : xenUnifiedOpen:306 : Trying XenD sub-driver
13:41:03.736: debug : xenUnifiedOpen:309 : Activated XenD sub-driver
13:41:03.736: debug : xenUnifiedOpen:315 : Trying XM sub-driver
13:41:03.736: debug : xenUnifiedOpen:318 : Activated XM sub-driver
13:41:03.736: debug : xenUnifiedOpen:322 : Trying XS sub-driver
13:41:03.736: debug : xenStoreOpen:346 : Failed to add event handle, disabling events

13:41:03.736: debug : xenUnifiedOpen:325 : Activated XS sub-driver
13:41:03.744: debug : xenUnifiedOpen:361 : Trying Xen inotify sub-driver
13:41:03.744: debug : xenInotifyOpen:439 : Adding a watch on /etc/xen
13:41:03.744: debug : xenInotifyOpen:451 : Building initial config cache
13:41:03.744: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/winxp
13:41:03.744: debug : xenXMConfigCacheAddFile:465 : Added config winxp /etc/xen/winxp
13:41:03.744: debug : xenXMConfigCacheAddFile:387 : Adding file /etc/xen/guest4
13:41:03.744: debug : xenXMConfigCacheAddFile:465 : Added config guest4 /etc/xen/guest4
13:41:03.744: debug : xenInotifyOpen:458 : Registering with event loop
13:41:03.744: debug : xenInotifyOpen:462 : Failed to add inotify handle, disabling events
13:41:03.744: debug : virConnectRef:1165 : conn=0x1b2f8420 refs=3
13:41:03.744: debug : xenUnifiedOpen:364 : Activated Xen inotify sub-driver
13:41:03.744: debug : do_open:936 : driver 1 Xen returned SUCCESS
13:41:03.745: debug : do_open:956 : network driver 0 Test returned DECLINED
13:41:03.745: debug : doRemoteOpen:513 : proceeding with name = xen:///
13:41:03.745: debug : call:6551 : Doing call 66 (nil)
13:41:03.745: debug : call:6621 : We have the buck 66 0x2aaaaaaf0010 0x2aaaaaaf0010
13:41:03.749: debug : processCallRecvLen:6209 : Got length, now need 36 total (32 more)
13:41:03.749: debug : processCalls:6477 : Giving up the buck 66 0x2aaaaaaf0010 (nil)
13:41:03.749: debug : call:6652 : All done with our call 66 (nil) 0x2aaaaaaf0010
13:41:03.749: debug : call:6551 : Doing call 1 (nil)
13:41:03.749: debug : call:6621 : We have the buck 1 0x1b33cbd0 0x1b33cbd0
13:41:03.755: debug : processCallRecvLen:6209 : Got length, now need 28 total (24 more)
13:41:03.755: debug : processCalls:6477 : Giving up the buck 1 0x1b33cbd0 (nil)
13:41:03.755: debug : call:6652 : All done with our call 1 (nil) 0x1b33cbd0
13:41:03.755: debug : doRemoteOpen:824 : Adding Handler for remote events
13:41:03.755: debug : doRemoteOpen:831 : virEventAddHandle failed: No addHandleImpl defined. continuing without events.
13:41:03.755: debug : do_open:956 : network driver 1 remote returned SUCCESS
13:41:03.755: debug : do_open:978 : storage driver 0 Test returned DECLINED
13:41:03.755: debug : do_open:978 : storage driver 1 remote returned SUCCESS
13:41:03.755: debug : do_open:999 : node driver 0 Test returned DECLINED
13:41:03.755: debug : do_open:999 : node driver 1 remote returned SUCCESS
>>> dev=conn.nodeDeviceLookupByName("storage_model_DVD__RW_DH_16A6S")
13:41:40.681: debug : virNodeDeviceLookupByName:7123 : conn=0x1b2f8420, name=0x2aea2f8fc054
13:41:40.681: debug : call:6551 : Doing call 113 (nil)
13:41:40.681: debug : call:6621 : We have the buck 113 0x1b33cbd0 0x1b33cbd0
13:41:40.681: debug : processCallRecvLen:6209 : Got length, now need 64 total (60 more)
13:41:40.681: debug : processCalls:6477 : Giving up the buck 113 0x1b33cbd0 (nil)
13:41:40.681: debug : call:6652 : All done with our call 113 (nil) 0x1b33cbd0
>>> dir(dev)
['XMLDesc', '__del__', '__doc__', '__init__', '__module__', '_conn', '_o', 'destroy', 'dettach', 'listCaps', 'name', 'numOfCaps', 'parent', 'reAttach', 'ref', 'reset']
>>> dev.listCaps()
13:41:53.482: debug : virNodeDeviceNumOfCaps:7254 : dev=0x1b330c80, conn=0x1b2f8420
13:41:53.482: debug : call:6551 : Doing call 116 (nil)
13:41:53.482: debug : call:6621 : We have the buck 116 0x1b33cbd0 0x1b33cbd0
13:41:53.482: debug : processCallRecvLen:6209 : Got length, now need 32 total (28 more)
13:41:53.482: debug : processCalls:6477 : Giving up the buck 116 0x1b33cbd0 (nil)
13:41:53.482: debug : call:6652 : All done with our call 116 (nil) 0x1b33cbd0
13:41:53.482: debug : virNodeDeviceListCaps:7294 : dev=0x1b330c80, conn=0x1b2f8420, names=0x1b332090, maxnames=1
13:41:53.482: debug : call:6551 : Doing call 117 (nil)
13:41:53.482: debug : call:6621 : We have the buck 117 0x1b33cbd0 0x1b33cbd0
13:41:53.482: debug : processCallRecvLen:6209 : Got length, now need 44 total (40 more)
13:41:53.482: debug : processCalls:6477 : Giving up the buck 117 0x1b33cbd0 (nil)
13:41:53.482: debug : call:6652 : All done with our call 117 (nil) 0x1b33cbd0
['storage']
>>> dev.parent()
13:42:00.970: debug : virNodeDeviceGetParent:7223 : dev=0x1b330c80, conn=0x1b2f8420
13:42:00.970: debug : call:6551 : Doing call 115 (nil)
13:42:00.970: debug : call:6621 : We have the buck 115 0x1b33cbd0 0x1b33cbd0
13:42:00.970: debug : processCallRecvLen:6209 : Got length, now need 80 total (76 more)
13:42:00.970: debug : processCalls:6477 : Giving up the buck 115 0x1b33cbd0 (nil)
13:42:00.970: debug : call:6652 : All done with our call 115 (nil) 0x1b33cbd0
'pci_8086_2922_scsi_host_3_scsi_device_lun0'
>>> dev.destroy()
13:42:09.322: debug : virNodeDeviceDestroy:7576 : dev=0x1b330c80
13:42:09.322: debug : call:6551 : Doing call 124 (nil)
13:42:09.322: debug : call:6621 : We have the buck 124 0x1b33cbd0 0x1b33cbd0
libvir: Remote error : server closed connection
13:42:09.325: debug : processCalls:6498 : Giving up the buck due to I/O error 124 0x1b33cbd0 (nil)
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/usr/lib64/python2.4/site-packages/libvirt.py", line 1462, in destroy
    if ret == -1: raise libvirtError ('virNodeDeviceDestroy() failed')
libvirt.libvirtError: server closed connection

-----------------------------------------------------------------------------

[root@dhcp-66-70-18 libvirt]# valgrind virsh nodedev-destroy storage_model_DVD__RW_DH_16A6S
==6696== Memcheck, a memory error detector.
==6696== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==6696== Using LibVEX rev 1658, a library for dynamic binary translation.
==6696== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==6696== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==6696== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==6696== For more details, rerun with: -v
==6696== 
==6696== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==6696==    This could cause spurious value errors to appear.
==6696==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==6696== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==6696==    This could cause spurious value errors to appear.
==6696==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
==6696== Warning: noted but unhandled ioctl 0x305000 with no size/direction hints
==6696==    This could cause spurious value errors to appear.
==6696==    See README_MISSING_SYSCALL_OR_IOCTL for guidance on writing a proper wrapper.
error: Failed to destroy node device 'storage_model_DVD__RW_DH_16A6S'
error: server closed connection

==6696== 
==6696== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 4 from 1)
==6696== malloc/free: in use at exit: 648,157 bytes in 905 blocks.
==6696== malloc/free: 2,379 allocs, 1,474 frees, 1,847,156 bytes allocated.
==6696== For counts of detected errors, rerun with: -v
==6696== searching for pointers to 905 not-freed blocks.
==6696== checked 11,816,656 bytes.
==6696== 
==6696== LEAK SUMMARY:
==6696==    definitely lost: 0 bytes in 0 blocks.
==6696==      possibly lost: 304 bytes in 1 blocks.
==6696==    still reachable: 647,853 bytes in 904 blocks.
==6696==         suppressed: 0 bytes in 0 blocks.
==6696== Reachable blocks (those to which a pointer was found) are not shown.
==6696== To see them, rerun with: --show-reachable=yes
Killed
Comment 12 Daniel Veillard 2009-07-01 11:19:17 EDT
#10 confirmed, probably a different bug though.
Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fdef5bd7910 (LWP 16680)]
0x00000034dd6332f5 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install libgcc-4.4.0-4.x86_64
(gdb) where
#0  0x00000034dd6332f5 in raise () from /lib64/libc.so.6
#1  0x00000034dd634b20 in abort () from /lib64/libc.so.6
#2  0x00000034dd67005d in __libc_message () from /lib64/libc.so.6
#3  0x00000034dd675a26 in malloc_printerr () from /lib64/libc.so.6
#4  0x00007fdef8ccf9ac in virFree (ptrptr=0x7fdef5bd6d78) at memory.c:177
#5  0x000000000043f8e1 in get_wwns (conn=0x7fdef0000960, 
    def=<value optimized out>, wwnn=0x7fdef5bd6db8, wwpn=0x7fdef5bd6db0)
    at node_device.c:456
#6  0x0000000000440121 in nodeDeviceDestroy (dev=0x7fdef0003630)
    at node_device.c:654
#7  0x00007fdef8ce54d9 in virNodeDeviceDestroy (dev=0x7fdef0003630)
    at libvirt.c:7593
#3  0x00000034dd675a26 in malloc_printerr () from /lib64/libc.so.6
(gdb) 
#4  0x00007fdef8ccf9ac in virFree (ptrptr=0x7fdef5bd6d78) at memory.c:177
177	    free(*(void**)ptrptr);
(gdb) 
#5  0x000000000043f8e1 in get_wwns (conn=0x7fdef0000960, 
    def=<value optimized out>, wwnn=0x7fdef5bd6db8, wwpn=0x7fdef5bd6db0)
    at node_device.c:456
456	        VIR_FREE(wwnn);
(gdb) p wwnn
$1 = (char **) 0x7fdef5bd6db8
(gdb) p *wwnn
$2 = 0x0

  we were freeing the wromg pointers there, I fixed it an thereafter
the device destroy works:

>>> conn=libvirt.open(None)
>>> dev=conn.nodeDeviceLookupByName("storage_model_DVD__RW_AD_5170S")
>>> dev.listCaps()
['storage']
>>> dev.destroy()
0
>>> 

I have built libvirt-0.6.3-13.el5 in dist-5E-qu-candidate with the fix and
updated the file list for further testing,
  thanks

Daniel
Comment 14 Alex Jia 2009-07-01 23:42:55 EDT
This bug has been verified with libvirt 0.6.3-13.el5 on RHEL-5.4. Already fixed, set status to VERIFIED.
Comment 16 errata-xmlrpc 2009-09-02 05:21:33 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2009-1269.html

Note You need to log in before you can comment on or make changes to this bug.