RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 817234 - libvirtd crash when start a net with special MAC address
Summary: libvirtd crash when start a net with special MAC address
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.3
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Peter Krempa
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-28 07:17 UTC by zhpeng
Modified: 2013-09-09 00:03 UTC (History)
10 users (show)

Fixed In Version: libvirt-0.9.10-17.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 823765 (view as bug list)
Environment:
Last Closed: 2012-06-20 06:57:53 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
libvirtd log (64.77 KB, text/plain)
2012-04-28 07:19 UTC, zhpeng
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0748 0 normal SHIPPED_LIVE Low: libvirt security, bug fix, and enhancement update 2012-06-19 19:31:38 UTC

Description zhpeng 2012-04-28 07:17:47 UTC
Description of Problem:
libvirtd crash when start a net with special MAC address

Version-Release number of selected component:
libvirt-0.9.10-14.el6.x86_64

How reproducible:
Always

Step to Reproduce:
virsh # net-list
Name                 State      Autostart
-----------------------------------------
default              active     yes      

virsh # net-destroy default
Network default destroyed

virsh # net-edit default
Network default XML configuration edited.
<network>
  <name>default</name>
  <uuid>0adda191-5e1a-43ef-9039-240076c9a6ca</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <mac address='FF:FFDD:EE:EE'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
    </dhcp>
  </ip>
</network>


virsh # net-start default
error: Failed to start network default
error: End of file while reading data: Input/output error

[root@zhpeng ~]# service libvirtd status
libvirtd dead but pid file exists


Actual Results:
libvirtd crashed

Expected Results:
no crash

Additional info:

Comment 1 zhpeng 2012-04-28 07:19:29 UTC
Created attachment 580941 [details]
libvirtd log

Comment 2 zhpeng 2012-04-28 07:26:38 UTC
One more problem:

Before i do these steps, the encode of libvirtd log is good, i can use gedit open libvirtd.log. But after i do these steps, many debug info write into the libvirtd.log and i can't use gedit open it. But i can use tail/less/vim read it.

Comment 3 Alex Jia 2012-04-28 08:10:20 UTC
(In reply to comment #0)
> 
> virsh # net-edit default
> Network default XML configuration edited.
> <network>
>   <name>default</name>
>   <uuid>0adda191-5e1a-43ef-9039-240076c9a6ca</uuid>
>   <forward mode='nat'/>
>   <bridge name='virbr0' stp='on' delay='0' />
>   <mac address='FF:FFDD:EE:EE'/>
It should be "<mac address='FF:FF:DD:DD:EE:EE'/>", copy-paste eats your ":DD:" in Zimbra, in addition, if you edit above line into default network on libvirt upstream, as expected, libvirt will raise the following error:

# virsh net-edit default
error: XML error: Invalid multicast bridge mac address 'FF:FF:DD:DD:EE:EE' in network 'default'

I tried to use '00:00:00:00:00' mac address, I can also reproduce the issue on libvirt upstream, however, it isn't reproducible every time.


And this issue is resulted by VIR_FORCE_CLOSE() deref a NULL 'tapfd' in virNetDevTapCreateInBridgePort() from src/util/virnetdevtap.c, I will try to fix it firstly.

Comment 4 Alex Jia 2012-05-02 02:49:15 UTC
In POST:

commit 5ee18aaa578768893918d67e0dc36fe72b73b736
Author: Alex Jia <ajia>
Date:   Sat Apr 28 19:01:40 2012 +0800

    util: Avoid libvirtd crash in virNetDevTapCreate
    
    In fact, the 'tapfd' is always NULL, the function 'virNetDevTapCreate()' hasn't
    assign 'fd' to 'tapfd', when the function 'virNetDevSetMAC()' is failed then
    goto 'error' label, finally, the VIR_FORCE_CLOSE() will deref a NULL 'tapfd'.
    
    * util/virnetdevtap.c (virNetDevTapCreateInBridgePort): fix a NULL pointer derefing.
    
    * How to reproduce?
    
    $ cat > /tmp/net.xml <<EOF
    <network>
      <name>test</name>
      <forward mode='nat'/>
      <bridge name='br1' stp='off' delay='1' />
      <mac address='00:00:00:00:00:00'/>
      <ip address='192.168.100.1' netmask='255.255.255.0'>
        <dhcp>
          <range start='192.168.100.2' end='192.168.100.254' />
        </dhcp>
      </ip>
    </network>
    EOF
    
    $ virsh net-define /tmp/net.xml
    
    $ virsh net-start test
    error: Failed to start network brTest
    error: End of file while reading data: Input/output error
    
    Signed-off-by: Alex Jia <ajia>

Comment 9 yanbing du 2012-05-11 05:24:59 UTC
Hi ajia, 
  I used libvirt-0.9.10-18.el6.x86_64 to test this bug, results like following:
Edit the 'default' network with 00:00:00:00:00:00 mac address, then 
# virsh net-start default
Network default started
# virsh net-dumpxml default
<network>
  <name>default</name>
  <uuid>8738a311-6441-4c1b-ac31-13f881044c7a</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <mac address='00:00:00:00:00:00'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
    </dhcp>
  </ip>
</network>
# ifconfig|grep HWaddr|grep virbr0
virbr0    Link encap:Ethernet  HWaddr 32:DA:C9:FF:89:85 

and check the libvirtd log, always 3 errors output:
#tail -f /var/log/libvirt/libvirtd.log 
012-05-11 05:10:22.044+0000: 12555: error : virCommandWait:2308 : internal error Child process (/sbin/tc qdisc del dev virbr0 root) status unexpected: exit status 2
2012-05-11 05:10:22.047+0000: 12555: error : virCommandWait:2308 : internal error Child process (/sbin/tc qdisc del dev virbr0 ingress) status unexpected: exit status 2
2012-05-11 05:10:50.603+0000: 12551: error : virNetDevSetMAC:170 : Cannot set interface MAC on 'virbr0-nic': Cannot assign requested address

Both '00:00:00:00:00:00' and 'FF:FF:FF:FF:EE:EE' these special mac address have the same result, that means the new mac address don't take effect. So if this behavior is expected?

Comment 10 Alex Jia 2012-05-11 05:39:35 UTC
(In reply to comment #9)
> and check the libvirtd log, always 3 errors output:
> #tail -f /var/log/libvirt/libvirtd.log 
> 012-05-11 05:10:22.044+0000: 12555: error : virCommandWait:2308 : internal
> error Child process (/sbin/tc qdisc del dev virbr0 root) status unexpected:
> exit status 2
> 2012-05-11 05:10:22.047+0000: 12555: error : virCommandWait:2308 : internal
> error Child process (/sbin/tc qdisc del dev virbr0 ingress) status unexpected:
> exit status 2
> 2012-05-11 05:10:50.603+0000: 12551: error : virNetDevSetMAC:170 : Cannot set
> interface MAC on 'virbr0-nic': Cannot assign requested address
> 
> Both '00:00:00:00:00:00' and 'FF:FF:FF:FF:EE:EE' these special mac address have
> the same result, that means the new mac address don't take effect. So if this
> behavior is expected?

The previous patch is used for fixing libvirtd crash for special MAC address, if libvirt hasn't crash again, I think we may move the bug to VERIFIED status.

Alex->Peter, please help confirm this, thanks.

In addition, please see Comment 3, if we give some special MAC address by net-edit then we can get some expected error message, for example, "Invalid multicast bridge mac address 'FF:FF:DD:DD:EE:EE'", so I think if we can't assign MAC address, virsh net-define or virsh net-start should raise a similar error information like virsh net-edit.

Comment 11 yanbing du 2012-05-22 06:19:00 UTC
According comment 9 and 10, since libvirtd will not crash, move this bug to VERIFY. 
BTW, filed a new bug 823765 to track the problem mentioned in comment 10.

Comment 13 errata-xmlrpc 2012-06-20 06:57:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0748.html


Note You need to log in before you can comment on or make changes to this bug.