qemu: segmentation fault in virtqemud executing qemuDomainUndefineFlags

[PATCH] qemu: segmentation fault in virtqemud executing qemuDomainUndefineFlags

Posted by Boris Fiuczynski 2 years, 1 month ago

Commit 5adfb3472342741c443ac91dee0abb18b5a3d038 causes a segmentation fault.

Stack trace of thread 664419:
 #0  0x000003ff62ec553c in qemuDomainUndefineFlags (dom=0x3ff6c002810, flags=<optimized out>) at ../src/qemu/qemu_driver.c:6618
 #1  0x000003ff876a7e5c in virDomainUndefineFlags (domain=domain@entry=0x3ff6c002810, flags=<optimized out>) at ../src/libvirt-domain.c:6519
 #2  0x000002aa2b64a808 in remoteDispatchDomainUndefineFlags (server=0x2aa2c3d7880, msg=0x2aa2c3d2770, args=<optimized out>, rerr=0x3ff8287b950, client=<optimized out>)
        at src/remote/remote_daemon_dispatch_stubs.h:13080
 #3  remoteDispatchDomainUndefineFlagsHelper (server=0x2aa2c3d7880, client=<optimized out>, msg=0x2aa2c3d2770, rerr=0x3ff8287b950, args=<optimized out>, ret=0x0)
        at src/remote/remote_daemon_dispatch_stubs.h:13059
 #4  0x000003ff8758bbf4 in virNetServerProgramDispatchCall (msg=0x2aa2c3d2770, client=0x2aa2c3e3050, server=0x2aa2c3d7880, prog=0x2aa2c3d8010)
        at ../src/rpc/virnetserverprogram.c:428
 #5  virNetServerProgramDispatch (prog=0x2aa2c3d8010, server=server@entry=0x2aa2c3d7880, client=0x2aa2c3e3050, msg=0x2aa2c3d2770) at ../src/rpc/virnetserverprogram.c:302
 #6  0x000003ff8758c260 in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:140
 #7  virNetServerHandleJob (jobOpaque=0x2aa2c3e2d30, opaque=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:160
 #8  0x000003ff874c49aa in virThreadPoolWorker (opaque=<optimized out>) at ../src/util/virthreadpool.c:164
 #9  0x000003ff874c3f62 in virThreadHelper (data=<optimized out>) at ../src/util/virthread.c:256
 #10 0x000003ff86c1cf8c in start_thread () from /lib64/libc.so.6
 #11 0x000003ff86c9650e in thread_start () from /lib64/libc.so.6

Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
---
 src/qemu/qemu_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index b74b0375a7..18f1156862 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6615,7 +6615,7 @@ qemuDomainUndefineFlags(virDomainPtr dom,
         }
     }
 
-    if (vm->def->os.loader->nvram) {
+    if (vm->def->os.loader && vm->def->os.loader->nvram) {
         nvram_path = g_strdup(vm->def->os.loader->nvram);
     } else if (vm->def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
         qemuDomainNVRAMPathFormat(cfg, vm->def, &nvram_path);
-- 
2.33.1

Re: [PATCH] qemu: segmentation fault in virtqemud executing qemuDomainUndefineFlags

Posted by Jim Fehlig 2 years, 1 month ago

On 3/1/22 10:47, Boris Fiuczynski wrote:
> Commit 5adfb3472342741c443ac91dee0abb18b5a3d038 causes a segmentation fault.
> 
> Stack trace of thread 664419:
>   #0  0x000003ff62ec553c in qemuDomainUndefineFlags (dom=0x3ff6c002810, flags=<optimized out>) at ../src/qemu/qemu_driver.c:6618
>   #1  0x000003ff876a7e5c in virDomainUndefineFlags (domain=domain@entry=0x3ff6c002810, flags=<optimized out>) at ../src/libvirt-domain.c:6519
>   #2  0x000002aa2b64a808 in remoteDispatchDomainUndefineFlags (server=0x2aa2c3d7880, msg=0x2aa2c3d2770, args=<optimized out>, rerr=0x3ff8287b950, client=<optimized out>)
>          at src/remote/remote_daemon_dispatch_stubs.h:13080
>   #3  remoteDispatchDomainUndefineFlagsHelper (server=0x2aa2c3d7880, client=<optimized out>, msg=0x2aa2c3d2770, rerr=0x3ff8287b950, args=<optimized out>, ret=0x0)
>          at src/remote/remote_daemon_dispatch_stubs.h:13059
>   #4  0x000003ff8758bbf4 in virNetServerProgramDispatchCall (msg=0x2aa2c3d2770, client=0x2aa2c3e3050, server=0x2aa2c3d7880, prog=0x2aa2c3d8010)
>          at ../src/rpc/virnetserverprogram.c:428
>   #5  virNetServerProgramDispatch (prog=0x2aa2c3d8010, server=server@entry=0x2aa2c3d7880, client=0x2aa2c3e3050, msg=0x2aa2c3d2770) at ../src/rpc/virnetserverprogram.c:302
>   #6  0x000003ff8758c260 in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:140
>   #7  virNetServerHandleJob (jobOpaque=0x2aa2c3e2d30, opaque=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:160
>   #8  0x000003ff874c49aa in virThreadPoolWorker (opaque=<optimized out>) at ../src/util/virthreadpool.c:164
>   #9  0x000003ff874c3f62 in virThreadHelper (data=<optimized out>) at ../src/util/virthread.c:256
>   #10 0x000003ff86c1cf8c in start_thread () from /lib64/libc.so.6
>   #11 0x000003ff86c9650e in thread_start () from /lib64/libc.so.6

libvirt-tck encountered the same segfault in my test environment.

> Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
> ---
>   src/qemu/qemu_driver.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Jim Fehlig <jfehlig@suse.com>

Regards,
Jim

> 
> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
> index b74b0375a7..18f1156862 100644
> --- a/src/qemu/qemu_driver.c
> +++ b/src/qemu/qemu_driver.c
> @@ -6615,7 +6615,7 @@ qemuDomainUndefineFlags(virDomainPtr dom,
>           }
>       }
>   
> -    if (vm->def->os.loader->nvram) {
> +    if (vm->def->os.loader && vm->def->os.loader->nvram) {
>           nvram_path = g_strdup(vm->def->os.loader->nvram);
>       } else if (vm->def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
>           qemuDomainNVRAMPathFormat(cfg, vm->def, &nvram_path);

Re: [PATCH] qemu: segmentation fault in virtqemud executing qemuDomainUndefineFlags

Posted by Michal Prívozník 2 years, 1 month ago

On 3/2/22 00:21, Jim Fehlig wrote:
> On 3/1/22 10:47, Boris Fiuczynski wrote:
>> Commit 5adfb3472342741c443ac91dee0abb18b5a3d038 causes a segmentation
>> fault.
>>
>> Stack trace of thread 664419:
>>   #0  0x000003ff62ec553c in qemuDomainUndefineFlags
>> (dom=0x3ff6c002810, flags=<optimized out>) at
>> ../src/qemu/qemu_driver.c:6618
>>   #1  0x000003ff876a7e5c in virDomainUndefineFlags
>> (domain=domain@entry=0x3ff6c002810, flags=<optimized out>) at
>> ../src/libvirt-domain.c:6519
>>   #2  0x000002aa2b64a808 in remoteDispatchDomainUndefineFlags
>> (server=0x2aa2c3d7880, msg=0x2aa2c3d2770, args=<optimized out>,
>> rerr=0x3ff8287b950, client=<optimized out>)
>>          at src/remote/remote_daemon_dispatch_stubs.h:13080
>>   #3  remoteDispatchDomainUndefineFlagsHelper (server=0x2aa2c3d7880,
>> client=<optimized out>, msg=0x2aa2c3d2770, rerr=0x3ff8287b950,
>> args=<optimized out>, ret=0x0)
>>          at src/remote/remote_daemon_dispatch_stubs.h:13059
>>   #4  0x000003ff8758bbf4 in virNetServerProgramDispatchCall
>> (msg=0x2aa2c3d2770, client=0x2aa2c3e3050, server=0x2aa2c3d7880,
>> prog=0x2aa2c3d8010)
>>          at ../src/rpc/virnetserverprogram.c:428
>>   #5  virNetServerProgramDispatch (prog=0x2aa2c3d8010,
>> server=server@entry=0x2aa2c3d7880, client=0x2aa2c3e3050,
>> msg=0x2aa2c3d2770) at ../src/rpc/virnetserverprogram.c:302
>>   #6  0x000003ff8758c260 in virNetServerProcessMsg (msg=<optimized
>> out>, prog=<optimized out>, client=<optimized out>, srv=0x2aa2c3d7880)
>> at ../src/rpc/virnetserver.c:140
>>   #7  virNetServerHandleJob (jobOpaque=0x2aa2c3e2d30,
>> opaque=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:160
>>   #8  0x000003ff874c49aa in virThreadPoolWorker (opaque=<optimized
>> out>) at ../src/util/virthreadpool.c:164
>>   #9  0x000003ff874c3f62 in virThreadHelper (data=<optimized out>) at
>> ../src/util/virthread.c:256
>>   #10 0x000003ff86c1cf8c in start_thread () from /lib64/libc.so.6
>>   #11 0x000003ff86c9650e in thread_start () from /lib64/libc.so.6
> 
> libvirt-tck encountered the same segfault in my test environment.
> 
>> Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
>> ---
>>   src/qemu/qemu_driver.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Reviewed-by: Jim Fehlig <jfehlig@suse.com>

Pushed now. I believe, this warrants maintenance release. Jirka?

Michal

Re: [PATCH] qemu: segmentation fault in virtqemud executing qemuDomainUndefineFlags

Posted by Jiri Denemark 2 years, 1 month ago

On Wed, Mar 02, 2022 at 09:49:35 +0100, Michal Prívozník wrote:
> On 3/2/22 00:21, Jim Fehlig wrote:
> > On 3/1/22 10:47, Boris Fiuczynski wrote:
> >> Commit 5adfb3472342741c443ac91dee0abb18b5a3d038 causes a segmentation
> >> fault.
>
> Pushed now. I believe, this warrants maintenance release. Jirka?

Well, the bug definitely deserves to be mentioned in NEWS.

We still mention maintenance branches and releases on our web, but we
haven't done them for quite some time. The most recent commit in a
maintenance branch is almost three years old. So the question is whether
anyone actually expects our maintenance releases. I believe pretty much
any downstream was doing their own backports and releases and the only
user of our maint branches was Fedora ages ago.

But I'm not against doing the release if we think it might help. If,
however, we decide not to do it, we should remove (or better rewrite)
the corresponding part of our docs to better match reality.

Jirka