Bug 996886 - libvirt segfaults in xdr_string() call
libvirt segfaults in xdr_string() call
Status: CLOSED DUPLICATE of bug 994855
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt (Show other bugs)
7.1
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Libvirt Maintainers
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-14 04:45 EDT by Gerd Hoffmann
Modified: 2013-08-14 07:56 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-14 07:56:59 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
vconsole src rpm (24.18 KB, application/x-rpm)
2013-08-14 04:49 EDT, Gerd Hoffmann
no flags Details
vconsole x86_64 rpm (22.93 KB, application/x-rpm)
2013-08-14 04:50 EDT, Gerd Hoffmann
no flags Details

  None (edit)
Description Gerd Hoffmann 2013-08-14 04:45:56 EDT
Description of problem:
$subject

Version-Release number of selected component (if applicable):
libvirt-1.1.1-2.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Fetch & build vconsole (http://www.kraxel.org/cgit/vconsole/)
2. Run vconsole, pick a virtual machine not running, tap enter
3. New tab opens for the VM, tap enter again (which boots it).

Actual results:
vconsole crashes while starting the guest,
with the stack trace ending somewhere deep in libvirt

Expected results:
vconsole continues to run, showing the serial console of the guest.

Additional info:
(gdb) bt
#0  0x0000003976d292d0 in xdr_string () from /lib64/libc.so.6
#1  0x0000003999d5fbde in xdr_remote_nonnull_string (xdrs=xdrs@entry=0x7fffffffc890, 
    objp=objp@entry=0x7fffffffcab0) at remote/remote_protocol.c:31
#2  0x0000003999d5ff11 in xdr_remote_nonnull_domain (xdrs=0x7fffffffc890, objp=0x7fffffffcab0)
    at remote/remote_protocol.c:58
#3  0x0000003999d62109 in xdr_remote_domain_create_with_flags_ret (xdrs=xdrs@entry=0x7fffffffc890, 
    objp=objp@entry=0x7fffffffcab0) at remote/remote_protocol.c:1762
#4  0x0000003999d74930 in virNetMessageDecodePayload (msg=msg@entry=0x9b5570, filter=filter@entry=
    0x3999d62100 <xdr_remote_domain_create_with_flags_ret>, data=data@entry=0x7fffffffcab0)
    at rpc/virnetmessage.c:404
#5  0x0000003999d6b57c in virNetClientProgramCall (prog=prog@entry=0x98fc60, 
    client=client@entry=0x98f8f0, serial=serial@entry=28, proc=proc@entry=196, 
    noutfds=noutfds@entry=0, outfds=outfds@entry=0x0, ninfds=ninfds@entry=0x0, 
    infds=infds@entry=0x0, 
    args_filter=args_filter@entry=0x3999d620c0 <xdr_remote_domain_create_with_flags_args>, 
    args=args@entry=0x7fffffffca80, 
    ret_filter=ret_filter@entry=0x3999d62100 <xdr_remote_domain_create_with_flags_ret>, 
    ret=ret@entry=0x7fffffffcab0) at rpc/virnetclientprogram.c:377
#6  0x0000003999d473e2 in callFull (priv=priv@entry=0x98ebb0, flags=flags@entry=0, 
    fdin=fdin@entry=0x0, fdinlen=fdinlen@entry=0, fdout=fdout@entry=0x0, 
    fdoutlen=fdoutlen@entry=0x0, proc_nr=proc_nr@entry=196, 
    args_filter=0x3999d620c0 <xdr_remote_domain_create_with_flags_args>, 
    args=args@entry=0x7fffffffca80 "\340\032\231", 
    ret_filter=ret_filter@entry=0x3999d62100 <xdr_remote_domain_create_with_flags_ret>, 
    ret=ret@entry=0x7fffffffcab0 "H", conn=<optimized out>) at remote/remote_driver.c:5651
#7  0x0000003999d4bf04 in call (conn=<optimized out>, ret=0x7fffffffcab0 "H", 
    ret_filter=<optimized out>, args=0x7fffffffca80 "\340\032\231", args_filter=<optimized out>, 
    proc_nr=196, flags=0, priv=0x98ebb0) at remote/remote_driver.c:5673
#8  remoteDomainCreateWithFlags (dom=0xa11760, flags=<optimized out>)
    at remote/remote_driver.c:2434
#9  0x0000003999d1c9f8 in virDomainCreateWithFlags (domain=domain@entry=0xa11760, flags=1)
    at libvirt.c:9499
#10 0x0000000000407dbf in domain_start (dom=0x992770) at domain.c:370
#11 0x0000003979c0fa28 in g_closure_invoke () from /lib64/libgobject-2.0.so.0
#12 0x0000003979c20a3d in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0
#13 0x0000003979c28829 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#14 0x0000003979c28a72 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#15 0x000000398da9b170 in _gtk_action_emit_activate () from /lib64/libgtk-3.so.0
#16 0x000000398dc5d249 in button_clicked () from /lib64/libgtk-3.so.0
#17 0x0000003979c0fc57 in _g_closure_invoke_va () from /lib64/libgobject-2.0.so.0
#18 0x0000003979c27d87 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#19 0x0000003979c28a72 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#20 0x000000398dac2088 in gtk_real_button_released () from /lib64/libgtk-3.so.0
#21 0x0000003979c0fa28 in g_closure_invoke () from /lib64/libgobject-2.0.so.0
#22 0x0000003979c20247 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0
#23 0x0000003979c28829 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#24 0x0000003979c28a72 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#25 0x000000398dac0c33 in gtk_button_button_release () from /lib64/libgtk-3.so.0
#26 0x000000398db8b06e in _gtk_marshal_BOOLEAN__BOXEDv () from /lib64/libgtk-3.so.0
---Type <return> to continue, or q <return> to quit---
#27 0x0000003979c0fc57 in _g_closure_invoke_va () from /lib64/libgobject-2.0.so.0
#28 0x0000003979c27d87 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#29 0x0000003979c28a72 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#30 0x000000398dcab3f4 in gtk_widget_event_internal () from /lib64/libgtk-3.so.0
#31 0x000000398db893bc in propagate_event () from /lib64/libgtk-3.so.0
#32 0x000000398db8ac55 in gtk_main_do_event () from /lib64/libgtk-3.so.0
#33 0x000000398b24bd62 in gdk_event_source_dispatch () from /lib64/libgdk-3.so.0
#34 0x0000003978c47e06 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#35 0x0000003978c48158 in g_main_context_iterate.isra.22 () from /lib64/libglib-2.0.so.0
#36 0x0000003978c4855a in g_main_loop_run () from /lib64/libglib-2.0.so.0
#37 0x000000398db8a15d in gtk_main () from /lib64/libgtk-3.so.0
#38 0x0000000000405be6 in main (argc=1, argv=0x7fffffffddc8) at vconsole.c:1068
Comment 2 Gerd Hoffmann 2013-08-14 04:49:23 EDT
Created attachment 786459 [details]
vconsole src rpm
Comment 3 Gerd Hoffmann 2013-08-14 04:50:04 EDT
Created attachment 786460 [details]
vconsole x86_64 rpm
Comment 4 Daniel Berrange 2013-08-14 07:48:07 EDT
The stack trace here shows a crash in decoding the RPC reply. This looks like it is the crash fixed upstream

commit be7a89e8cabbc0e222b9e39c6266ece576295fe3
Author: Alex Jia <ajia@redhat.com>
Date:   Thu Aug 8 16:44:57 2013 +0800

    remote: Fix a segfault in remoteDomainCreateWithFlags
    

which dealt with the fact that we did not 'memset' the 'ret' variable. This fix is post-1.1.1 so would not be present in RHEL-7 trees
Comment 5 Martin Kletzander 2013-08-14 07:56:59 EDT

*** This bug has been marked as a duplicate of bug 994855 ***

Note You need to log in before you can comment on or make changes to this bug.