Bug 808371 - libvirtd crashed with SIGSEGV in __strcmp_ssse3()
libvirtd crashed with SIGSEGV in __strcmp_ssse3()
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt (Show other bugs)
6.3
x86_64 Linux
high Severity high
: rc
: ---
Assigned To: Alex Jia
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-30 05:39 EDT by Alex Jia
Modified: 2012-06-20 02:51 EDT (History)
7 users (show)

See Also:
Fixed In Version: libvirt-0.9.10-10.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-20 02:51:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Alex Jia 2012-03-30 05:39:26 EDT
Description of problem:
virsh edit a channel without target name into guest XML configuration then create a snapshot for the shut off status guest, finally, to use virsh snapshot-current to set current snapshot name, libvirt will crash due to derefing a NULL pointer.

Version-Release number of selected component (if applicable):
# rpm -q libvirt
libvirt-0.9.10-6.el6.x86_64

How reproducible:
always

Steps to Reproduce:

# qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 10M
Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=10485760 encryption=off cluster_size=65536

# cat > /tmp/test.xml <<EOF
<domain type='qemu'>
  <name>test</name>
  <memory>219200</memory>
  <vcpu>1</vcpu>
  <os>
    <type arch='x86_64'>hvm</type>
    <boot dev='hd'/>
  </os>
  <devices>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/test.img'/>
      <target dev='vda' bus='virtio'/>
    </disk>
    <channel type='pty'>
      <target type='virtio'/>
    </channel>
    <input type='mouse' bus='ps2'/>
    <graphics type='spice' autoport='yes' listen='0.0.0.0'/>
  </devices>
</domain>
EOF

# virsh define /tmp/test.xml
Domain test defined from /tmp/test.xml

# virsh snapshot-list test
 Name                 Creation Time             State
------------------------------------------------------------

# virsh snapshot-create-as test hello
Domain snapshot hello created

# virsh snapshot-list test
 Name                 Creation Time             State
------------------------------------------------------------
 hello                2012-03-30 17:30:13 +0800 shutoff

# virsh snapshot-current test hello
error: End of file while reading data: Input/output error


Actual results:

# service libvirtd status
libvirtd dead but pid file exists

Expected results:
avoid crashing libvirtd.

Additional info:

Run till exit from #0  __strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:187

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:213

(gdb) bt
#0  __strcmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:213
#1  0x00007f77dee24fd3 in virDomainChannelDefCheckABIStability (src=0x7f77cc1886c0, dst=0x7f77c80d2630) at conf/domain_conf.c:9496
#2  virDomainDefCheckABIStability (src=0x7f77cc1886c0, dst=0x7f77c80d2630) at conf/domain_conf.c:9862
#3  0x000000000044e948 in qemuDomainSnapshotCreateXML (domain=<value optimized out>, xmlDesc=<value optimized out>, flags=<value optimized out>) at qemu/qemu_driver.c:10165
#4  0x00007f77dee78c8c in virDomainSnapshotCreateXML (domain=0x7f77c80bf650, 
    xmlDesc=0x7f77c80c2eb0 "<domainsnapshot>\n  <name>hello</name>\n  <state>shutoff</state>\n  <creationTime>1333095328</creationTime>\n  <domain type='kvm'>\n    <name>foo-clone</name>\n    <uuid>fea1e273-6516-c52c-634a-d735c68524dd"..., flags=3) at libvirt.c:17089
#5  0x000000000042a9ef in remoteDispatchDomainSnapshotCreateXML (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>, rerr=0x7f77d84edbc0, args=0x7f77c80c0130, 
    ret=0x7f77c80c0170) at remote_dispatch.h:5485
#6  remoteDispatchDomainSnapshotCreateXMLHelper (server=<value optimized out>, client=<value optimized out>, msg=<value optimized out>, rerr=0x7f77d84edbc0, args=0x7f77c80c0130, ret=0x7f77c80c0170)
    at remote_dispatch.h:5461
#7  0x00007f77deeb2615 in virNetServerProgramDispatchCall (prog=0x13dbe80, server=0x13d0ac0, client=0x13dc530, msg=0x141ca20) at rpc/virnetserverprogram.c:416
#8  virNetServerProgramDispatch (prog=0x13dbe80, server=0x13d0ac0, client=0x13dc530, msg=0x141ca20) at rpc/virnetserverprogram.c:289
#9  0x00007f77deeb1411 in virNetServerHandleJob (jobOpaque=<value optimized out>, opaque=0x13d0ac0) at rpc/virnetserver.c:164
#10 0x00007f77dedf5bbc in virThreadPoolWorker (opaque=<value optimized out>) at util/threadpool.c:144
#11 0x00007f77dedf54d9 in virThreadHelper (data=<value optimized out>) at util/threads-pthread.c:161
#12 0x00000038baa077f1 in start_thread (arg=0x7f77d84ee700) at pthread_create.c:301
#13 0x00000033f68e570d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
Comment 1 Alex Jia 2012-03-30 05:41:34 EDT
Patch for upstream:
https://www.redhat.com/archives/libvir-list/2012-March/msg01324.html
Comment 3 Alex Jia 2012-03-30 05:44:16 EDT
(In reply to comment #0)
> Version-Release number of selected component (if applicable):
> # rpm -q libvirt
> libvirt-0.9.10-6.el6.x86_64
It exists the same issue on libvirt-0.9.10-9.el6.x86_64.
Comment 5 Daniel Veillard 2012-04-04 23:19:45 EDT
Upstream commit 814fcb9e08fdc80ff2d74d5ca205b9c8bd0d351c

Daniel
Comment 8 Huang Wenlong 2012-04-06 00:07:08 EDT
Verify this bug :

libvirt-0.9.10-10.el6.x86_64
qemu-kvm-0.12.1.2-2.267.el6.x86_64


Steps: 

# qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 10M
Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=10485760
encryption=off cluster_size=65536

# cat > /tmp/test.xml <<EOF
<domain type='qemu'>
  <name>test</name>
  <memory>219200</memory>
  <vcpu>1</vcpu>
  <os>
    <type arch='x86_64'>hvm</type>
    <boot dev='hd'/>
  </os>
  <devices>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/test.img'/>
      <target dev='vda' bus='virtio'/>
    </disk>
    <channel type='pty'>
      <target type='virtio'/>
    </channel>
    <input type='mouse' bus='ps2'/>
    <graphics type='spice' autoport='yes' listen='0.0.0.0'/>
  </devices>
</domain>
EOF

# virsh define /tmp/test.xml
Domain test defined from /tmp/test.xml

# virsh snapshot-list test
 Name                 Creation Time             State
------------------------------------------------------------

# virsh snapshot-create-as test hello
Domain snapshot hello created

# virsh snapshot-list test
 Name                 Creation Time             State
------------------------------------------------------------
 hello                2012-03-30 17:30:13 +0800 shutoff

# virsh snapshot-current test hello
Snapshot hello set as current

# /etc/init.d/libvirtd status
libvirtd (pid  26619) is running...
Comment 10 errata-xmlrpc 2012-06-20 02:51:23 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0748.html

Note You need to log in before you can comment on or make changes to this bug.