Bug 711206 - [libvirt] [logs] null dereference while preparing libvirt logs
Summary: [libvirt] [logs] null dereference while preparing libvirt logs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.1
Hardware: All
OS: Linux
urgent
medium
Target Milestone: rc
: 6.1
Assignee: Eric Blake
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On: 640202
Blocks: 728546
TreeView+ depends on / blocked
 
Reported: 2011-06-06 20:05 UTC by Eric Blake
Modified: 2013-01-11 03:59 UTC (History)
20 users (show)

Fixed In Version: libvirt-0.9.4-1.el6
Doc Type: Bug Fix
Doc Text:
Previously, when a debug process was being activated, the act of preparing a debug message ended up with dereferencing a UUID (universally unique identifier) prior to the NULL argument check. Consequently, an API running the debug process sometimes terminated with a segmentation fault. With this update, a patch has been provided to address this issue, and the crashes no longer occur in the described scenario.
Clone Of: 640202
Environment:
Last Closed: 2011-12-06 11:14:47 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1513 0 normal SHIPPED_LIVE libvirt bug fix and enhancement update 2011-12-06 01:23:30 UTC

Comment 5 Eric Blake 2011-08-05 14:31:14 UTC
This is already built into 0.9.4-1.el6 for RHEL 6.2.

Comment 7 yanbing du 2011-08-10 12:52:39 UTC
Verified this bug with libvirt-0.9.4-2.el6.x86_64.
Test steps:
1. Edit /etc/libvirt/libvirtd.conf.
   set log_level = 1
   set log_outputs = "1:file:/tmp/libvirtd.log"
2. kill libvirtd process
    # kill `pidof libvirtd`
3. start libvirtd in foreground:
   # libvirtd
4. #virsh destroy test
   #virsh start test
   #grep 92dd267d-3ac5-4338-9d18-328cf3526a88 -i /tmp/libvirtd.log 
------
20:31:24.331: 3152: debug : virLockManagerLogParams:98 :   key=uuid type=uuid value=92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.334: 3152: debug : virDomainFree:2144 : dom=0x7f936c110590, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
20:31:24.334: 3152: debug : virReleaseDomain:238 : release domain 0x7f936c110590 test 92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.335: 3154: debug : virDomainLookupByUUID:1922 : conn=0x7f935c000a60, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.335: 3154: debug : virDomainFree:2144 : dom=0x7f9364007700, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
20:31:24.335: 3154: debug : virReleaseDomain:238 : release domain 0x7f9364007700 test 92dd267d-3ac5-4338-9d18-328cf3526a88
20:39:45.498: 3155: debug : virDomainFree:2144 : dom=0x7f93600008e0, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
------

Comment 8 yanbing du 2011-08-12 11:13:32 UTC
Please help to confirm if these test steps are enough to verify this bug. Thanks!

Comment 9 Eric Blake 2011-08-12 12:46:10 UTC
(In reply to comment #7)
> Verified this bug with libvirt-0.9.4-2.el6.x86_64.
> Test steps:
> 1. Edit /etc/libvirt/libvirtd.conf.
>    set log_level = 1
>    set log_outputs = "1:file:/tmp/libvirtd.log"
> 2. kill libvirtd process
>     # kill `pidof libvirtd`
> 3. start libvirtd in foreground:
>    # libvirtd
> 4. #virsh destroy test
>    #virsh start test
>    #grep 92dd267d-3ac5-4338-9d18-328cf3526a88 -i /tmp/libvirtd.log 

That verifies that the log messages have sane uuids (the fix for bug 640202), but does not verify the NULL pointer dereference fixes (this bug).  To do that, you need to write a custom libvirt client that intentionally passes a NULL pointer for a UUID argument (not a valid use of the API, but the API is documented as detecting it as invalid).  The call should fail with invalid argument, but not crash, and the log should mention uuid=(null).

Comment 10 Daniel Berrangé 2011-08-12 12:59:42 UTC
Here is such a demo program:

$ cat > demo.c <<EOF
#include <libvirt/libvirt.h>
#include <stdlib.h>

int main(void) {
  virInitialize();
  virDomainDestroy(NULL);
}

EOF

$ gcc -o demo -lvirt demo.c

This is what you should see for correct behaviour:

$ LIBVIRT_DEBUG=1 ./demo 2>&1 | grep Destroy
13:58:15.178: 11291: debug : virDomainDestroy:2049 : dom=(nil), (VM: name=(null), uuid=), 
libvir: Domain error : invalid domain pointer in virDomainDestroy

Comment 11 Tomas Capek 2011-08-18 14:00:05 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Previously, when a debug process was being activated, the act of preparing a debug message ended up with dereferencing a UUID (universally unique identifier) prior to the NULL argument check. Consequently, an API running the debug process sometimes terminated with a segmentation fault. With this update, a patch has been provided to address this issue, and the crashes no longer occur in the described scenario.

Comment 12 errata-xmlrpc 2011-12-06 11:14:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1513.html


Note You need to log in before you can comment on or make changes to this bug.