Bug 523418 - xmldesc with a typo makes libvirtd sefault
Summary: xmldesc with a typo makes libvirtd sefault
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: libvirt
Version: 5.4
Hardware: All
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Daniel Veillard
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-15 12:23 UTC by Dan Kenigsberg
Modified: 2010-03-30 08:09 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-30 08:09:57 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
trivial backport to RHEL-5.4 of upstream patch (635 bytes, patch)
2009-11-18 17:18 UTC, Daniel Veillard
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2010:0205 0 normal SHIPPED_LIVE libvirt bug fix and enhancement update 2010-03-29 12:27:37 UTC

Description Dan Kenigsberg 2009-09-15 12:23:08 UTC
Description of problem:
I've used createLinux with the following section in xmldesc
    <interface type='bridge'>
       <target def='vnet8'/>
    </interface>
note that "def" instead of "dev". It's ok for libvirt not to like it, but it should not die.

Version-Release number of selected component (if applicable):
libvirt-0.6.3-20.1.el5_4

How reproducible:
always

Steps to Reproduce:
conn.createLinux(xmldesc, 0)
with xmldesc=

  <domain type='kvm'>
  <name>segfault</name>
  <uuid>9ffe28b6-6134-4b1e-8804-1185f49c436f</uuid>
  <memory>256</memory>
  <currentMemory>256</currentMemory>
  <os>
    <type arch='i686' machine='pc'>hvm</type>
    <boot dev='hd'/>
  </os>
  <devices>
    <interface type='bridge'>
       <target def='vnet8'/>
    </interface>
    <serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target port='0'/>
    </console>
    <input type='mouse' bus='ps2'/>
    <graphics type='vnc' port='5910' autoport='no' listen='0'/>
  </devices>
</domain>

Actual results:
libvirtd dead

Expected results:
error code returned

Additional info:

Comment 1 Daniel Veillard 2009-09-30 16:47:15 UTC
Fix is trivial, posted it upstream, I expect to have this fixed there
real soon:

https://www.redhat.com/archives/libvir-list/2009-September/msg00931.html

Not sure if it's worth a Z-Stream errata, but we should definitely fix this
for 5.5 at least,

Daniel

Comment 2 Dan Kenigsberg 2009-09-30 17:09:55 UTC
wow, I'm so lucky to have stepped on the only place where virXMLPropString()'s return value was not tested.

Comment 3 Daniel Veillard 2009-10-01 10:11:39 UTC
Well fix is upstream now, I will try to push the fix on the RHEL-5 branch
but no hurry if we don't do a an errata for it.

Daniel

Comment 4 Daniel Veillard 2009-11-18 17:18:57 UTC
Created attachment 370139 [details]
trivial backport to RHEL-5.4 of upstream patch

Comment 5 Daniel Veillard 2009-11-25 16:10:22 UTC
libvirt-0.6.3-22.el5 has been built in dist-5E-qu-candidate with
the fixes,

Daniel

Comment 7 Gunannan Ren 2009-12-31 06:01:45 UTC
The bugs has been fixed in libvirt-0.6.3-28.el5

I tried the bug on libvirt-0.6.3-20.el5 using "virsh define segfault.xml" XMLdesc like above xml definition. Libvirt reports error:
error:Faied to define domain from segfault.xml
error:server closed connection

and at the same time, the libvirtd died. 
the output of "service libvirtd status" is libvirtd dead but pid file exists

on libvirt-0.6.3-28.el5
error: Failed to define domain from segfault.xml
error: internal error No <source> 'dev' attribute specified with <interface type='bridge'/>

the libvirt daemon is running.

Comment 12 errata-xmlrpc 2010-03-30 08:09:57 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2010-0205.html


Note You need to log in before you can comment on or make changes to this bug.