1. Patchew
  2. Libvirt
  3. View series

[libvirt] [PATCH] qemu:json: Fix daemon crash on handling domain shutdown event

Erik Skultety posted 1 patch 7 years, 11 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/cc73326c6a25a1037fa9d04801eee7a015c93c3e.1496133659.git.eskultet@redhat.com
src/qemu/qemu_monitor_json.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[libvirt] [PATCH] qemu:json: Fix daemon crash on handling domain shutdown event
Posted by Erik Skultety 7 years, 11 months ago 
commit a8eba5036 added further checking of the guest shutdown cause, but
this enhancement is available since qemu 2.10, causing a crash because
of a NULL pointer dereference on older qemus.

Thread 1 "libvirtd" received signal SIGSEGV, Segmentation fault.
0x00007ffff72441af in virJSONValueObjectGet (object=0x0,
                                             key=0x7fffd5ef11bf "guest")
    at util/virjson.c:769
769	    if (object->type != VIR_JSON_TYPE_OBJECT)
(gdb) bt
0  in virJSONValueObjectGet
1  in virJSONValueObjectGetBoolean
2  in qemuMonitorJSONHandleShutdown
3  in qemuMonitorJSONIOProcessEvent
4  in qemuMonitorJSONIOProcessLine
5  in qemuMonitorJSONIOProcess
6  in qemuMonitorIOProcess
7  in qemuMonitorIO
8  in virEventPollDispatchHandles
9  in virEventPollRunOnce
10 in virEventRunDefaultImpl
11 in virNetDaemonRun
12 in main

Signed-off-by: Erik Skultety <eskultet@redhat.com>
---
 src/qemu/qemu_monitor_json.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
index 757595dd7..f208dd05a 100644
--- a/src/qemu/qemu_monitor_json.c
+++ b/src/qemu/qemu_monitor_json.c
@@ -528,7 +528,7 @@ static void qemuMonitorJSONHandleShutdown(qemuMonitorPtr mon, virJSONValuePtr da
     bool guest = false;
     virTristateBool guest_initiated = VIR_TRISTATE_BOOL_ABSENT;
 
-    if (virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
+    if (data && virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
         guest_initiated = guest ? VIR_TRISTATE_BOOL_YES : VIR_TRISTATE_BOOL_NO;
 
     qemuMonitorEmitShutdown(mon, guest_initiated);
-- 
2.13.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH] qemu:json: Fix daemon crash on handling domain shutdown event
Posted by Peter Krempa 7 years, 11 months ago 
On Tue, May 30, 2017 at 10:41:17 +0200, Erik Skultety wrote:
> commit a8eba5036 added further checking of the guest shutdown cause, but
> this enhancement is available since qemu 2.10, causing a crash because
> of a NULL pointer dereference on older qemus.
> 
> Thread 1 "libvirtd" received signal SIGSEGV, Segmentation fault.
> 0x00007ffff72441af in virJSONValueObjectGet (object=0x0,
>                                              key=0x7fffd5ef11bf "guest")
>     at util/virjson.c:769
> 769	    if (object->type != VIR_JSON_TYPE_OBJECT)
> (gdb) bt
> 0  in virJSONValueObjectGet
> 1  in virJSONValueObjectGetBoolean
> 2  in qemuMonitorJSONHandleShutdown
> 3  in qemuMonitorJSONIOProcessEvent
> 4  in qemuMonitorJSONIOProcessLine
> 5  in qemuMonitorJSONIOProcess
> 6  in qemuMonitorIOProcess

I think you can truncate is somewhere here.

> 7  in qemuMonitorIO
> 8  in virEventPollDispatchHandles
> 9  in virEventPollRunOnce
> 10 in virEventRunDefaultImpl
> 11 in virNetDaemonRun
> 12 in main
> 
> Signed-off-by: Erik Skultety <eskultet@redhat.com>
> ---
>  src/qemu/qemu_monitor_json.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
> index 757595dd7..f208dd05a 100644
> --- a/src/qemu/qemu_monitor_json.c
> +++ b/src/qemu/qemu_monitor_json.c
> @@ -528,7 +528,7 @@ static void qemuMonitorJSONHandleShutdown(qemuMonitorPtr mon, virJSONValuePtr da
>      bool guest = false;
>      virTristateBool guest_initiated = VIR_TRISTATE_BOOL_ABSENT;
>  
> -    if (virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
> +    if (data && virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
>          guest_initiated = guest ? VIR_TRISTATE_BOOL_YES : VIR_TRISTATE_BOOL_NO;
>  
>      qemuMonitorEmitShutdown(mon, guest_initiated);

ACK, safe for freeze

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH] qemu:json: Fix daemon crash on handling domain shutdown event
Posted by Erik Skultety 7 years, 11 months ago 
On Tue, May 30, 2017 at 10:53:44AM +0200, Peter Krempa wrote:
> On Tue, May 30, 2017 at 10:41:17 +0200, Erik Skultety wrote:
> > commit a8eba5036 added further checking of the guest shutdown cause, but
> > this enhancement is available since qemu 2.10, causing a crash because
> > of a NULL pointer dereference on older qemus.
> >
> > Thread 1 "libvirtd" received signal SIGSEGV, Segmentation fault.
> > 0x00007ffff72441af in virJSONValueObjectGet (object=0x0,
> >                                              key=0x7fffd5ef11bf "guest")
> >     at util/virjson.c:769
> > 769	    if (object->type != VIR_JSON_TYPE_OBJECT)
> > (gdb) bt
> > 0  in virJSONValueObjectGet
> > 1  in virJSONValueObjectGetBoolean
> > 2  in qemuMonitorJSONHandleShutdown
> > 3  in qemuMonitorJSONIOProcessEvent
> > 4  in qemuMonitorJSONIOProcessLine
> > 5  in qemuMonitorJSONIOProcess
> > 6  in qemuMonitorIOProcess
>
> I think you can truncate is somewhere here.
>
> > 7  in qemuMonitorIO
> > 8  in virEventPollDispatchHandles
> > 9  in virEventPollRunOnce
> > 10 in virEventRunDefaultImpl
> > 11 in virNetDaemonRun
> > 12 in main
> >
> > Signed-off-by: Erik Skultety <eskultet@redhat.com>
> > ---
> >  src/qemu/qemu_monitor_json.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
> > index 757595dd7..f208dd05a 100644
> > --- a/src/qemu/qemu_monitor_json.c
> > +++ b/src/qemu/qemu_monitor_json.c
> > @@ -528,7 +528,7 @@ static void qemuMonitorJSONHandleShutdown(qemuMonitorPtr mon, virJSONValuePtr da
> >      bool guest = false;
> >      virTristateBool guest_initiated = VIR_TRISTATE_BOOL_ABSENT;
> >
> > -    if (virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
> > +    if (data && virJSONValueObjectGetBoolean(data, "guest", &guest) == 0)
> >          guest_initiated = guest ? VIR_TRISTATE_BOOL_YES : VIR_TRISTATE_BOOL_NO;
> >
> >      qemuMonitorEmitShutdown(mon, guest_initiated);
>
> ACK, safe for freeze
>

Adjusted the commit message and pushed, thanks.
Erik



--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Patchew 2.1-devel-8c64711

© 2016 - 2025 Red Hat, Inc.