RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 845460 - exit console will crash libvirtd
Summary: exit console will crash libvirtd
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.4
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Peter Krempa
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-03 07:11 UTC by zhpeng
Modified: 2018-11-29 19:54 UTC (History)
11 users (show)

Fixed In Version: libvirt-0.10.0-0rc1.el6
Doc Type: Bug Fix
Doc Text:
Bug in previously added feature
Clone Of:
Environment:
Last Closed: 2013-02-21 07:20:42 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
libvirtd log (64.12 KB, text/plain)
2012-08-03 07:11 UTC, zhpeng 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0276 0 normal SHIPPED_LIVE Moderate: libvirt security, bug fix, and enhancement update 2013-02-20 21:18:26 UTC

Description zhpeng 2012-08-03 07:11:03 UTC 
Created attachment 602074 [details]
libvirtd log

Description of problem:
exit console will crash libvirtd

Version-Release number of selected component (if applicable):
libvirt-0.10.0-0rc0.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
[root@zhpeng ~]# virsh console test
Connected to domain test
Escape character is ^]           ------> press ctrl+]

[root@zhpeng ~]# virsh list
error: Failed to reconnect to the hypervisor
error: no valid connection
error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Connection refused

[root@zhpeng ~]# service libvirtd status
libvirtd dead but pid file exists

Actually results:
libvirtd crashed

Expected results:
all be fine

Additional info:
pls use "less" view the libvirtd.log
Comment 2 Alex Jia 2012-08-03 09:06:34 UTC 
BTW, libvirt upstream is fine without this issue.
Comment 3 Peter Krempa 2012-08-03 09:14:01 UTC 
(In reply to comment #2)
> BTW, libvirt upstream is fine without this issue.

The crash is reproducible also on upstream.
Comment 4 Alex Jia 2012-08-03 09:21:01 UTC 
(In reply to comment #3)
> (In reply to comment #2)
> > BTW, libvirt upstream is fine without this issue.
> 
> The crash is reproducible also on upstream.

It's strange for me, I haven't reproduce it on upstream, but the crash is indeed reproducible on libvirt-0.10.0-0rc0.el6.x86_64, it's a use after free issue.
Comment 5 Peter Krempa 2012-08-03 09:29:25 UTC 
Fix sent for review upstream

http://www.redhat.com/archives/libvir-list/2012-August/msg00168.html
Comment 7 Peter Krempa 2012-08-03 21:50:39 UTC 
Fixed upstream with:

commit 45edefc7a7bcbec988f54331ff37fc32e4bc2718
Author: Peter Krempa <pkrempa>
Date:   Fri Aug 3 11:20:29 2012 +0200

    conf: Remove console stream callback only when freeing console helper
    
    Commit ba226d334acbc49f6751b430e0c4e00f69eef6bf tried to fix crash of
    the daemon when a domain with an open console was destroyed. The fix was
    wrong as it tried to remove the callback also when the stream was
    aborted, where at that point the fd stream driver was already freed and
    removed.
    
    This patch clears the callbacks with a helper right before the hash is
    freed, so that it doesn't interfere with other codepaths where the
    stream object is freed.

and moving to POST.
Comment 9 hongming 2012-08-27 02:01:25 UTC 
Verified it using libvirt-0.10.0-0rc1.el6.x86_64 , The result is expected. So move its status to VERIFIED.

Steps

1. # virsh console rhel6
Connected to domain rhel6
Escape character is ^]   ------> press ctrl+]


2.# virsh list 
 Id    Name                           State
----------------------------------------------------
 43    win                            running
 44    rhel6                          running


3.# service libvirtd status
libvirtd (pid  23792) is running...
Comment 10 errata-xmlrpc 2013-02-21 07:20:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0276.html
Note You need to log in before you can comment on or make changes to this bug.