From nobody Tue Aug 25 02:50:00 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1787043104; cv=none; d=zohomail.com; s=zohoarc; b=YHBnhnC/YO/ZwxkBJKREKFexJB9nwD4S7Xk3jeqHIC7FjZD6i58dhx5/xgiPVAOj4qC19dm6t5tsWaPPwH7Ii9/Cv12J9/VJkPdXSG+PE/LKVk7yxENNE4CmgqbcOQIbO5vTZTealgo/JlKOi6zlfLJoVj3OBzR1pXTzd3SekOY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787043104; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=KZYWfQzxRi5jH76fM4GH2dwSq4ol7uUPDaWB4vMZsO4=; b=eusnNoPnibgwPmFzzBOlaJhu3thg90UtlkhBRMC0cDSMEwHWQ3tMC/R+vHKWwycUN5GJGkYO/SUXElpphK9QsYQaRf6L3AO2a/zyqkFXkNSqXfNhRq3H0MSBLvv1mE6rP27Ng4p2aCRjAWtU5hvBawJjx3e0lNCtRAMI/iKm6hw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 178704310453444.56015353965233; Tue, 18 Aug 2026 01:51:44 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id ED7803F8A2; Tue, 18 Aug 2026 04:51:42 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id C0738419F3 for ; Tue, 18 Aug 2026 04:50:25 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E45293F88D; Tue, 18 Aug 2026 04:50:15 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 52C243F36A for ; Tue, 18 Aug 2026 04:50:14 -0400 (EDT) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-304-s2ic5SlKPhuNBJiLxxy3pg-1; Tue, 18 Aug 2026 04:50:12 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 15898180035C for ; Tue, 18 Aug 2026 08:50:11 +0000 (UTC) Received: from moe (unknown [10.43.3.236]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 74B8A1956042 for ; Tue, 18 Aug 2026 08:50:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787043013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KZYWfQzxRi5jH76fM4GH2dwSq4ol7uUPDaWB4vMZsO4=; b=JXJCnKKL9OgtHTVXB1Fd0kUdZE6slDXdj3UwJtNgoR4+4NEGPxapy4gYoZ1iiJKCo6twUo OYnPHJDjRKayAnHW6IpePLhVXhbNtmTYWv2LkOxRYXSYsktfvoErRQPUY9cQQxsd1ERmUJ YB7ZlHRaCUegKIoFZS46U6lrlbcqHAU= X-MC-Unique: s2ic5SlKPhuNBJiLxxy3pg-1 X-Mimecast-MFC-AGG-ID: s2ic5SlKPhuNBJiLxxy3pg_1787043011 To: devel@lists.libvirt.org Subject: [PATCH] esx: Don't crash when parsing unmounted datastore Date: Tue, 18 Aug 2026 10:50:08 +0200 Message-ID: <60a0d6308aecd469aadfd174ea28984bd64f580a.1787042929.git.mprivozn@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: PRlOglzpvzTSCMXM6YqMM9aMzgj-8YlhKeprCyVpRKE_1787043011 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: O5RN66P2PJHSRPQGC6QANO25XLQNMEYL X-Message-ID-Hash: O5RN66P2PJHSRPQGC6QANO25XLQNMEYL X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1787043104998158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik When parsing disk source in ESX driver (esxParseVMXFileName()) the datastore is traversed through trying to find matching prefix. But not every datastore has to be mounted. In that case, esxVI_LookupDatastoreHostMount() returns success and the returned struct has mountInfo->path set to NULL. This can be deducted from the following backtrace (which shows that strlen() hidden in STRSKIP() macro was given NULL pointer). Thread 1 "virsh" received signal SIGSEGV, Segmentation fault. __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 76 VPCMPEQ (%rdi), %ymm0, %ymm1 (gdb) bt full #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 No locals. #1 0x00007ffff7c292d7 in esxParseVMXFileName (fileName=3D0x5555557341d0 "/= vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msaf= ra-RHEL9-shared-1_1.vmdk", opaque=3D0x7fffffffcf80, out=3D0x7fffffffc738, allow_missing=3Dfalse) at ../src/esx/esx_driver.c= :172 data =3D 0x7fffffffcf80 propertyNameList =3D 0x555555738b50 datastoreList =3D 0x55555573cf40 datastore =3D hostMount =3D 0x555555733640 datastoreName =3D 0x55555573e590 "mnecas-nfs-test" tmp =3D saveptr =3D 0x5555556a5b50 "" strippedFileName =3D 0x0 copyOfFileName =3D 0x0 directoryAndFileName =3D ret =3D -1 __FUNCTION__ =3D "esxParseVMXFileName" #2 0x00007ffff7bd47f4 in virVMXParseDisk (ctx=3Dctx@entry=3D0x7fffffffcfb0= , xmlopt=3Dxmlopt@entry=3D0x555555738d80, conf=3Dconf@entry=3D0x5555556a5b5= 0, device=3Ddevice@entry=3D0, busType=3D, busType@entry=3D3, controllerOrBus=3DcontrollerOrBus@entry=3D1, unit=3D, de= f=3D0x7fffffffc960, vmdef=3D0x5555557375a0) at ../src/vmx/vmx.c:2553 tmp =3D 0x0 result =3D -1 prefix =3D 0x5555557384d0 "scsi1:0" present_name =3D "scsi1:0.present", '\000' present =3D true startConnected_name =3D "scsi1:0.startConnected\000\000\000\000\000= \000\000\000\000" startConnected =3D true deviceType_name =3D "scsi1:0.deviceType", '\000' deviceType =3D 0x555555737f60 "scsi-hardDisk" clientDevice_name =3D "scsi1:0.clientDevice", '\000' clientDevice =3D false fileType_name =3D "scsi1:0.fileType", '\000' fileType =3D 0x0 fileName_name =3D "scsi1:0.fileName", '\000' fileName =3D 0x5555557341d0 "/vmfs/volumes/5f64209f-c0af0aa8-70c4-e= 4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk" writeThrough_name =3D "scsi1:0.writeThrough", '\000' writeThrough =3D false mode_name =3D "scsi1:0.mode", '\000' mode =3D 0x0 cleanup =3D __FUNCTION__ =3D "virVMXParseDisk" #3 0x00007ffff7bd5f01 in virVMXParseConfig (ctx=3D0x7fffffffcfb0, xmlopt= =3D0x555555738d80, caps=3D, vmx=3D) at ../src= /vmx/vmx.c:1749 #4 0x00007ffff7c35319 in esxDomainGetXMLDesc (domain=3D, fl= ags=3D0) at ../src/esx/esx_driver.c:2595 #5 0x00007ffff7cc4fd3 in virDomainGetXMLDesc (domain=3Ddomain@entry=3D0x55= 55557367f0, flags=3Dflags@entry=3D0) at ../src/libvirt-domain.c:2898 #6 0x0000555555586cca in cmdDumpXML (ctl=3D0x7fffffffd1d0, cmd=3D0x5555556= a5450) at ../tools/virsh-domain.c:10787 #7 0x00005555555bc7cb in vshCommandRun (ctl=3D0x7fffffffd1d0, cmd=3D0x5555= 556a5450) at ../tools/vsh.c:1383 #8 0x0000555555562fbc in main (argc=3D, argv=3D0x7fffffffd5= c8) at ../tools/virsh.c:900 The backtrace was trimmed. To fix this, just check whether mount path is not NULL before passing it to STRSKIP(). Resolves: https://redhat.atlassian.net/browse/RHEL-213506 Signed-off-by: Michal Privoznik Reviewed-by: Martin Kletzander --- BTW: this crasher is easily reproducible with our test suite too. Just comment line 49 in tests/vmx2xmlmock.c file and run vmx2xmltest. src/esx/esx_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index c5b3fa47b6..75bbd07750 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -169,6 +169,9 @@ esxParseVMXFileName(const char *fileName, goto cleanup; } =20 + if (!hostMount->mountInfo->path) + continue; + tmp =3D (char *)STRSKIP(fileName, hostMount->mountInfo->path); =20 if (!tmp) --=20 2.54.0