581750 – Vhost: Segfault when assigning a none vhostfd

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 581750 - Vhost: Segfault when assigning a none vhostfd

Summary: Vhost: Segfault when assigning a none vhostfd

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	qemu-kvm
Sub Component:
Version:	6.0
Hardware:	All
OS:	Linux
Priority:	low
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	jason wang
QA Contact:	Virtualization Bugs
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	580953 642595
TreeView+	depends on / blocked

Reported:	2010-04-13 07:30 UTC by Amos Kong
Modified:	2015-05-25 00:05 UTC (History)
CC List:	7 users (show)
Fixed In Version:	qemu-kvm-0.12.1.2-2.119.el6
Doc Type:	Bug Fix
Doc Text:	Cause: bug in the file descriptor parameter handling code Consequence: When specifying a invalid vhostfd , qemu-kvm would crash. Fix: Fix file descriptor parameter handling code. Result: When specify a invalid vhostfd, qemu-kvm would end with a warning and never crash.
Clone Of:
Environment:
Last Closed:	2011-05-19 11:33:01 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0534	0	normal	SHIPPED_LIVE	Important: qemu-kvm security, bug fix, and enhancement update	2011-05-19 11:20:36 UTC

Description Amos Kong 2010-04-13 07:30:16 UTC

Description of problem:
# ls /none
ls: cannot access /none: No such file or directory

Boot up a guest with "..vhost=on,vhostfd=/none.." option, it always causes a segment fault.

Version-Release number of selected component (if applicable):
# rpm -qa |grep qemu
qemu-kvm-0.12.1.2-2.37.el6.x86_64
qemu-img-0.12.1.2-2.37.el6.x86_64
qemu-kvm-tools-0.12.1.2-2.37.el6.x86_64
gpxe-roms-qemu-0.9.7-6.2.el6.noarch
qemu-kvm-debuginfo-0.12.1.2-2.37.el6.x86_64

# uname -a
Linux localhost.localdomain.englab.nay.redhat.com 2.6.32-19.el6.x86_64 #1 SMP Tue Mar 9 17:48:46 EST 2010 x86_64 x86_64 x86_64 GNU/Linux


How reproducible:
always

Steps to Reproduce:
1. boot up a guest with "..vhost=on,vhostfd=/none.." option
  
Actual results:
segment fault occurred

Expected results:
guest can boot up

Additional info:
commandline:
# /usr/libexec/qemu-kvm -no-hpet -usbdevice tablet -rtc-td-hack -startdate now -cpu qemu64,+sse2 -drive file=/home/image/RHEL-Server-5.5-64.qcow2 -net nic,model=virtio,netdev=foo,macaddr=20:20:11:23:22:03 -netdev tap,id=foo,ifname=msttap0,vhost=on,vhostfd=/none,script=/etc/qemu-ifup,downscript=no -vnc :1 -m 2G -smp 2 -boot c -monitor stdio -uuid `uuidgen`

backtrace:

# gdb /usr/libexec/qemu-kvm
GNU gdb (GDB) Red Hat Enterprise Linux (7.1-10.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/libexec/qemu-kvm...Reading symbols from /usr/lib/debug/usr/libexec/qemu-kvm.debug...done.
done.
(gdb) r -no-hpet -usbdevice tablet -rtc-td-hack -startdate now -cpu qemu64,+sse2 -drive file=/home/image/RHEL-Server-5.5-64.qcow2 -net nic,model=virtio,netdev=foo,macaddr=20:20:11:23:22:03 -netdev tap,id=foo,ifname=msttap0,vhost=on,vhostfd=/none,script=/etc/qemu-ifup,downscript=no -vnc :1 -m 2G -smp 2 -boot c -monitor stdio -uuid `uuidgen`
Starting program: /usr/libexec/qemu-kvm -no-hpet -usbdevice tablet -rtc-td-hack -startdate now -cpu qemu64,+sse2 -drive file=/home/image/RHEL-Server-5.5-64.qcow2 -net nic,model=virtio,netdev=foo,macaddr=20:20:11:23:22:03 -netdev tap,id=foo,ifname=msttap0,vhost=on,vhostfd=/none,script=/etc/qemu-ifup,downscript=no -vnc :1 -m 2G -smp 2 -boot c -monitor stdio -uuid `uuidgen`
[Thread debugging using libthread_db enabled]
Detaching after fork from child process 20678.

Program received signal SIGSEGV, Segmentation fault.
monitor_get_fd (mon=0x0, fdname=0x115a190 "/none") at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:2591
2591        QLIST_FOREACH(monfd, &mon->fds, next) {
Missing separate debuginfos, use: debuginfo-install alsa-lib-1.0.21-3.el6.x86_64 cairo-spice-1.8.7.1-4.el6.x86_64 celt051-0.5.1.3-0.el6.x86_64 cyrus-sasl-lib-2.1.23-4.1.el6.x86_64 dbus-libs-1.2.16-10.el6.x86_64 expat-2.0.1-8.el6.x86_64 ffmpeg-spice-libs-0.4.9-0.15.5spice.20080908.el6.x86_64 fontconfig-2.8.0-1.el6.x86_64 freetype-2.3.11-3.el6.x86_64 glibc-2.11.1-1.12.el6.x86_64 gnutls-2.8.5-2.el6.x86_64 keyutils-libs-1.2-6.1.el6.x86_64 krb5-libs-1.7-18.el6.x86_64 libICE-1.0.6-1.el6.x86_64 libSM-1.1.0-7.1.el6.x86_64 libX11-1.3-1.el6.x86_64 libXau-1.0.5-1.el6.x86_64 libXdamage-1.1.2-1.el6.x86_64 libXext-1.1-2.el6.x86_64 libXfixes-4.0.4-1.el6.x86_64 libXi-1.3-1.el6.x86_64 libXtst-1.0.99.2-3.el6.x86_64 libXxf86vm-1.1.0-1.el6.x86_64 libaio-0.3.107-9.1.el6.x86_64 libasyncns-0.8-1.1.el6.x86_64 libcom_err-1.41.10-3.el6.x86_64 libdrm-2.4.17-1.el6.x86_64 libgcc-4.4.3-15.el6.x86_64 libgcrypt-1.4.5-2.el6.x86_64 libgpg-error-1.7-2.el6.x86_64 libpng-1.2.39-1.el6.x86_64 libselinux-2.0.87-1.el6.x86_64 libsndfile-1.0.20-3.el6.x86_64 libstdc++-4.4.3-1.el6.x86_64 libtasn1-2.3-2.el6.x86_64 libuuid-2.17.1-1.el6.x86_64 libxcb-1.5-1.el6.x86_64 mesa-libGL-7.7-1.el6.x86_64 mesa-libGLU-7.7-1.el6.x86_64 nss-softokn-freebl-3.12.4-11.el6.x86_64 openssl-1.0.0-0.19.beta4.el6.x86_64 pciutils-libs-3.1.4-6.el6.x86_64 pixman-spice-0.13.3-5.el6.x86_64 pulseaudio-libs-0.9.21-8.el6.x86_64 spice-server-0.4.2-8.el6.x86_64 tcp_wrappers-libs-7.6-56.2.el6.x86_64 zlib-1.2.3-23.1.el6.x86_64
(gdb) bt
#0  monitor_get_fd (mon=0x0, fdname=0x115a190 "/none") at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:2591
#1  0x00000000004917c1 in net_handle_fd_param (mon=0x0, param=0x115a190 "/none") at net.c:744
#2  0x0000000000494da8 in net_init_tap (opts=0x1159f50, mon=0x0, name=<value optimized out>, vlan=<value optimized out>) at net/tap.c:470
#3  0x00000000004742aa in qemu_opts_foreach (list=<value optimized out>, func=0x491be0 <net_init_netdev>, opaque=0x0,
    abort_on_failure=<value optimized out>) at qemu-option.c:817
#4  0x0000000000490f50 in net_init_clients () at net.c:1355
#5  0x000000000040d445 in main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6035

Comment 2 RHEL Program Management 2010-04-13 08:14:02 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Comment 3 Dor Laor 2010-05-06 13:44:44 UTC

It seems minor bug to me, ain't it?

Comment 4 Michael S. Tsirkin 2010-05-09 09:03:56 UTC

Yes, it's a minor bug. I'll fix it when I get to it.

Comment 5 RHEL Program Management 2010-07-15 14:00:17 UTC

This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release. It has
been denied for the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **

Comment 17 Amos Kong 2010-12-22 00:40:13 UTC

could not reproduce with qemu-kvm-0.12.1.2-2.127.el6.x86_64, moving to VERIFIED.

Comment 18 jason wang 2011-05-05 09:57:38 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: bug in the file descriptor parameter handling code

Consequence: When specifying a invalid vhostfd , qemu-kvm would crash.

Fix: Fix file descriptor parameter handling code.

Result: When specify a invalid vhostfd, qemu-kvm would end with a warning and never crash.

Comment 19 errata-xmlrpc 2011-05-19 11:33:01 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0534.html

Comment 20 errata-xmlrpc 2011-05-19 12:45:09 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0534.html

Note You need to log in before you can comment on or make changes to this bug.