Red Hat Bugzilla – Bug 852592
libvirtd will be crashed when run vcpupin more than once
Last modified: 2013-02-21 02:22:27 EST
Description of problem: When pin vcpu using vcpupin command more than once . the libvirtd will be crashed. Version-Release number of selected component (if applicable): libvirt-0.10.0-0rc1.el6.x86_64 qemu-kvm-0.12.1.2-2.295.el6.x86_64 How reproducible: 100% Steps to Reproduce: 1.# virsh start rhel6.2 Domain rhel6.2 started 2.# virsh dumpxml rhel6.2 ...... <vcpu placement='static'>5</vcpu> ...... 3.# virsh nodeinfo CPU model: x86_64 CPU(s): 4 CPU frequency: 1600 MHz CPU socket(s): 1 Core(s) per socket: 4 Thread(s) per core: 1 NUMA cell(s): 1 Memory size: 7946252 KiB 4. Run the vcpupin command more than once. # virsh vcpupin rhel6.2 0 1-2 # virsh vcpupin rhel6.2 1 1-2 # virsh vcpupin rhel6.2 2 3 # virsh vcpupin rhel6.2 3 3 error: End of file while reading data: Input/output error error: Failed to reconnect to the hypervisor Actual results: libvirtd is crashed Expected results: libvirtd works fine Additional info:
Created attachment 607726 [details] libvirt debug log
Patches sent upstream: http://www.redhat.com/archives/libvir-list/2012-August/msg01912.html
Fixed upstream with: commit 077e7bf51f17c20bcf49aac1dff79247e13d5d6d Author: Peter Krempa <pkrempa@redhat.com> Date: Thu Aug 30 15:38:37 2012 +0200 vcpupin: Fix returning of arrays from virDomainVcpuPinAdd virDomainVcpuPinAdd does a realloc on vcpupin_list if the new vcpu pin definition doesn't fit into the array. The list is an array of pointers but the function definition didn't support returning the changed pointer to the caller if it was realloced. This caused segfaults if realloc would change the base pointer. In my scenario, the fourth CPU that was pinned (fourth as in fourth virsh command, you may plug them in any order) caused a reallocation that invalidated the pointer. Up to 3 cpus it worked. Moving to POST.
Verify with libvirt-0.10.1-1.el6.x86_64. Following the bug reproduce steps, do several times vcpupin, and libvirtd still running.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0276.html