Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 928265

Summary: updateDeviceFlags might crash libvirtd
Product: Red Hat Enterprise Linux 7 Reporter: Wayne Sun <gsun>
Component: libvirtAssignee: Peter Krempa <pkrempa>
Status: CLOSED CURRENTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 7.0CC: acathrow, cwei, dyuan, lsu, mzhan
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: libvirt-1.0.5-1.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 11:48:11 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
backtrace file
none
thread apply all bt
none
libvirtd coredump file none

Description Wayne Sun 2013-03-27 09:44:10 UTC
Description of problem:
libvirtd got crashed when live update floppy device

prepare a domain with empty floppy:
# virsh dumpxml virtlab_test
...
    <disk type='file' device='floppy'>
      <driver name='qemu' type='raw'/>
      <target dev='fda' bus='fdc'/>
      <alias name='fdc0-0-0'/>
      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
    </disk>
...

prepare floppy image and update xml

# cat /tmp/floppy.xml 
<disk type='file' device='floppy'>
  <driver name='qemu' type='raw'/>
  <source file='/tmp/floppy.img'/>
  <target dev='fda' bus='fdc'/>
</disk>

# cat /tmp/floppy-eject.xml 
<disk type='file' device='floppy'>
  <driver name='qemu' type='raw'/>
  <target dev='fda' bus='fdc'/>
</disk>


# cat updatedev_floppy.py 
#!/usr/bin/env python

import libvirt

xmlpath = '/tmp/floppy.xml'
xmlpath_ = '/tmp/floppy-eject.xml'
domname = 'virtlab_test'

f = open(xmlpath, 'r')
devxml = f.read()
f.close()

flags = libvirt.VIR_DOMAIN_DEVICE_MODIFY_LIVE
conn = libvirt.open(None)
dom = conn.lookupByName(domname)
dom.updateDeviceFlags(devxml, flags)

f = open(xmlpath_, 'r')
devxml = f.read()
f.close()

dom.updateDeviceFlags(devxml, flags)

Run the script serveral times the libvirtd will crash:

# python updatedev_floppy.py
# python updatedev_floppy.py 
# python updatedev_floppy.py 
# python updatedev_floppy.py 
^[[Alibvirt: XML-RPC error : End of file while reading data: Input/output error
Traceback (most recent call last):
  File "updatedev_floppy.py", line 16, in <module>
    dom.updateDeviceFlags(devxml, flags)
  File "/usr/lib64/python2.7/site-packages/libvirt.py", line 1869, in updateDeviceFlags
    if ret == -1: raise libvirtError ('virDomainUpdateDeviceFlags() failed', dom=self)
libvirt.libvirtError: End of file while reading data: Input/output error


Version-Release number of selected component (if applicable):
libvirt-1.0.3-1.el7.x86_64
qemu-kvm-1.4.0-1.el7.x86_64
kernel-3.7.0-0.36.el7.x86_64


How reproducible:
sometime

Steps to Reproduce:
1. as description
2.
3.
  
Actual results:
libvirtd crashed

Expected results:
libvirtd should not crash

Additional info:
core dump file and backtrace attached

Comment 2 Wayne Sun 2013-03-27 09:51:55 UTC
Created attachment 716971 [details]
backtrace file

Comment 3 Wayne Sun 2013-03-27 09:53:48 UTC
Created attachment 716972 [details]
thread apply all bt

Comment 4 Wayne Sun 2013-03-28 10:43:19 UTC
Created attachment 717587 [details]
libvirtd coredump file

Comment 5 Peter Krempa 2013-04-02 21:50:06 UTC
Fixed upstream:

commit 43b6f304bce5937f1e3a852b20b52a772b39b95f
Author: Peter Krempa <pkrempa>
Date:   Tue Apr 2 23:15:00 2013 +0200

    qemu: Fix crash when updating media with shared device
    
    Mimic the fix done in 02b9097274d1330c2e1dca7f598880e09b5c2aa0 to fix crash by
    accessing an already freed structure. Also copy the explaining comment why the
    pointer can't be accessed any more.

v1.0.4-20-g43b6f30

Comment 6 Huang Wenlong 2013-05-06 07:53:27 UTC
Reproduce this bug with :
libvirt-1.0.4-1.1.el7.x86_64
Verify this bug with: 
libvirt-1.0.5-1.el7.x86_64.rpm

steps as comment 0 
libvirtd do not crash

Comment 7 Ludek Smid 2014-06-13 11:48:11 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.