[Pkg-libvirt-maintainers] Bug#565983: Bug#565983: libvirt-bin: libvirtd crashes when accessed through virt-manager

[Luca Tettamanti]

On Fri, Jan 22, 2010 at 1:21 PM, Guido Günther <agx at sigxcpu.org> wrote:
>
> ----- Ursprüngliche Mitteilung -----
>> On Thu, Jan 21, 2010 at 11:49:47PM +0100, Laurent Léonard wrote:
>> > Le jeudi 21 janvier 2010 à 23:16, Luca Tettamanti a écrit :
>> > > I encountered the same problem on my machine. The bug appeared after a
>> > > recent upgrade, I've downgraded to 0.7.5-4 and I can connect with
>> > > virt-manager again.
>> >
>> > I noticed libvirt only crashed at the first connection with Virt-manager. If I
>> > start libvirt again and try to reconnect it works. I can confirm all Debian
>> > revisions of libvirt 0.7.5 are affected by that bug.
>> >
>> > See the upstream bug report https://bugzilla.redhat.com/show_bug.cgi?id=556815
>> > for more informations.
>>
>> The stack trace matches what I'm seeing on my machine, however 0.7.5-4 works
>> fine here. I only connect via ssh though.
> The trace lacks the glibc part (libc6-dbg).

Yeah, this is production machine...

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f8115bb8910 (LWP 17259)]
strlen () at ../sysdeps/x86_64/strlen.S:31
31      ../sysdeps/x86_64/strlen.S: No such file or directory.
        in ../sysdeps/x86_64/strlen.S
Current language:  auto; currently asm
(gdb) bt
#0  strlen () at ../sysdeps/x86_64/strlen.S:31
#1  0x00007f8119508516 in *__GI___strdup (s=0x63735f74736f6850
<Address 0x63735f74736f6850 out of bounds>) at strdup.c:42
#2  0x000000000041d1ff in remoteDispatchNodeDeviceLookupByName
(server=<value optimized out>, client=<value optimized out>,
    conn=0x14ea030, hdr=<value optimized out>, rerr=0x7f8115bb7e30,
args=<value optimized out>, ret=0x7f8115bb7e80)
    at remote.c:5401
#3  0x0000000000424ab1 in remoteDispatchClientCall (server=<value
optimized out>, client=0x7f810c000ac0, msg=0x7f810c000c10)
    at dispatch.c:506
#4  0x0000000000424e63 in remoteDispatchClientRequest
(server=0x14c7570, client=0x7f810c000ac0, msg=0x7f810c000c10)
    at dispatch.c:388
#5  0x000000000041826c in qemudWorker (data=<value optimized out>) at
libvirtd.c:1522
#6  0x00007f81197e973a in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#7  0x00007f811955a6dd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#8  0x0000000000000000 in ?? ()
(gdb) disas
Dump of assembler code for function strlen:
0x00007f81195087b0 <strlen+0>:  mov    %rdi,%rcx
0x00007f81195087b3 <strlen+3>:  mov    %rdi,%r8
0x00007f81195087b6 <strlen+6>:  and    $0xfffffffffffffff0,%rdi
0x00007f81195087ba <strlen+10>: pxor   %xmm1,%xmm1
0x00007f81195087be <strlen+14>: or     $0xffffffffffffffff,%esi
0x00007f81195087c1 <strlen+17>: movdqa (%rdi),%xmm0
0x00007f81195087c5 <strlen+21>: sub    %rdi,%rcx
0x00007f81195087c8 <strlen+24>: lea    0x10(%rdi),%rdi
0x00007f81195087cc <strlen+28>: pcmpeqb %xmm1,%xmm0
0x00007f81195087d0 <strlen+32>: shl    %cl,%esi
0x00007f81195087d2 <strlen+34>: pmovmskb %xmm0,%edx
0x00007f81195087d6 <strlen+38>: xor    %eax,%eax
0x00007f81195087d8 <strlen+40>: neg    %r8
0x00007f81195087db <strlen+43>: and    %esi,%edx
0x00007f81195087dd <strlen+45>: jne    0x7f81195087f3 <strlen+67>
0x00007f81195087df <strlen+47>: movdqa (%rdi),%xmm0
0x00007f81195087e3 <strlen+51>: lea    0x10(%rdi),%rdi
0x00007f81195087e7 <strlen+55>: pcmpeqb %xmm1,%xmm0
0x00007f81195087eb <strlen+59>: pmovmskb %xmm0,%edx
0x00007f81195087ef <strlen+63>: test   %edx,%edx
0x00007f81195087f1 <strlen+65>: je     0x7f81195087df <strlen+47>
0x00007f81195087f3 <strlen+67>: lea    -0x10(%rdi,%r8,1),%rdi
0x00007f81195087f8 <strlen+72>: bsf    %edx,%eax
0x00007f81195087fb <strlen+75>: add    %rdi,%rax
0x00007f81195087fe <strlen+78>: retq
End of assembler dump.

strdup is called by make_nonnull_node_device (which is inlined):
dev_dst->name = strdup(dev_src->name);

Luca