Memory overwritten in qemuProcessReadLog triggers SIGABRT to termiante libvirtd

Bug #1654542 reported by Gavin Guo on 2017-01-06
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Undecided
Unassigned

Bug Description

The call trace can be observed by bt in the gdb with the coredump of libvirtd:
$ gdb /usr/sbin/libvirtd core.compute-0-1.domain.tld.1480020436.libvirtd.26138
(gdb) bt
#0 0x00007f856dddec37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f856dde2028 in __GI_abort () at abort.c:89
#2 0x00007f856de1b2a4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7f856df296b0 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007f856de25ff7 in malloc_printerr (action=<optimized out>, str=0x7f856df25905 "realloc(): invalid next size", ptr=<optimized out>)
    at malloc.c:4996
#4 0x00007f856de29827 in _int_realloc (av=<optimized out>, oldp=0x7f8538032060, oldsize=<optimized out>, nb=<optimized out>) at malloc.c:4234
#5 0x00007f856de2aed9 in __GI___libc_realloc (oldmem=0x7f8538032070, bytes=2327) at malloc.c:3029
#6 0x00007f856e7f8350 in virReallocN (ptrptr=ptrptr@entry=0x7f8563ad7460, size=size@entry=1, count=count@entry=2327, report=report@entry=false,
    domcode=domcode@entry=0, filename=filename@entry=0x0, funcname=funcname@entry=0x0, linenr=linenr@entry=0) at ../../../src/util/viralloc.c:245
#7 0x00007f85580cdc56 in qemuProcessReadLog (msg=0x7f8563ad7458, logCtxt=0x7f8538032987) at ../../../src/qemu/qemu_process.c:1684
#8 qemuProcessReportLogError (logCtxt=logCtxt@entry=0x7f8538024700, msgprefix=0x7f8558159550 "process exited while connecting to monitor")
    at ../../../src/qemu/qemu_process.c:1696
#9 0x00007f85580cdfa8 in qemuProcessWaitForMonitor (driver=driver@entry=0x7f85501106d0, vm=vm@entry=0x7f853c023000, asyncJob=asyncJob@entry=6,
    qemuCaps=0x7f853801d890, logCtxt=logCtxt@entry=0x7f8538024700) at ../../../src/qemu/qemu_process.c:1957
#10 0x00007f85580d269b in qemuProcessLaunch (conn=conn@entry=0x7f8538000a30, driver=driver@entry=0x7f85501106d0, vm=vm@entry=0x7f853c023000,
    asyncJob=asyncJob@entry=QEMU_ASYNC_JOB_START, incoming=incoming@entry=0x0, snapshot=snapshot@entry=0x0,
    vmop=vmop@entry=VIR_NETDEV_VPORT_PROFILE_OP_CREATE, flags=flags@entry=3) at ../../../src/qemu/qemu_process.c:4955
#11 0x00007f85580d60a9 in qemuProcessStart (conn=conn@entry=0x7f8538000a30, driver=driver@entry=0x7f85501106d0, vm=vm@entry=0x7f853c023000,
    asyncJob=asyncJob@entry=QEMU_ASYNC_JOB_START, migrateFrom=migrateFrom@entry=0x0, migrateFd=migrateFd@entry=-1, migratePath=migratePath@entry=0x0,
    snapshot=snapshot@entry=0x0, vmop=vmop@entry=VIR_NETDEV_VPORT_PROFILE_OP_CREATE, flags=flags@entry=3) at ../../../src/qemu/qemu_process.c:5152
#12 0x00007f8558136518 in qemuDomainObjStart (conn=0x7f8538000a30, driver=driver@entry=0x7f85501106d0, vm=0x7f853c023000, flags=flags@entry=1,
    asyncJob=QEMU_ASYNC_JOB_START) at ../../../src/qemu/qemu_driver.c:7396
#13 0x00007f8558136c56 in qemuDomainCreateWithFlags (dom=0x7f8538006ed0, flags=1) at ../../../src/qemu/qemu_driver.c:7450
#14 0x00007f856e91f7cd in virDomainCreateWithFlags (domain=domain@entry=0x7f8538006ed0, flags=1) at ../../../src/libvirt-domain.c:6816
#15 0x0000559ab0a8b6be in remoteDispatchDomainCreateWithFlags (server=0x559ab225ee90, msg=0x559ab227c350, ret=0x7f8538014090, args=0x7f8538014440,
    rerr=0x7f8563ad7c30, client=<optimized out>) at ../../../daemon/remote_dispatch.h:3698
#16 remoteDispatchDomainCreateWithFlagsHelper (server=0x559ab225ee90, client=<optimized out>, msg=0x559ab227c350, rerr=0x7f8563ad7c30,
    args=0x7f8538014440, ret=0x7f8538014090) at ../../../daemon/remote_dispatch.h:3673
#17 0x00007f856e992872 in virNetServerProgramDispatchCall (msg=0x559ab227c350, client=0x559ab2279cf0, server=0x559ab225ee90, prog=0x559ab22763c0)
    at ../../../src/rpc/virnetserverprogram.c:437
#18 virNetServerProgramDispatch (prog=0x559ab22763c0, server=server@entry=0x559ab225ee90, client=0x559ab2279cf0, msg=0x559ab227c350)
    at ../../../src/rpc/virnetserverprogram.c:307
#19 0x00007f856e98cdcd in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x559ab225ee90)
    at ../../../src/rpc/virnetserver.c:135
#20 virNetServerHandleJob (jobOpaque=<optimized out>, opaque=0x559ab225ee90) at ../../../src/rpc/virnetserver.c:156
#21 0x00007f856e864745 in virThreadPoolWorker (opaque=opaque@entry=0x559ab2251490) at ../../../src/util/virthreadpool.c:145
#22 0x00007f856e8636d8 in virThreadHelper (data=<optimized out>) at ../../../src/util/virthread.c:206
#23 0x00007f856e175184 in start_thread (arg=0x7f8563ad8700) at pthread_create.c:312
#24 0x00007f856dea237d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Tags: sts Edit Tag help
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers