[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH 1/1] Fix the crash when seclable is freed

On 2013年04月02日 19:29, Michal Privoznik wrote:
On 02.04.2013 07:58, Li Zhang wrote:
From: Li Zhang <zhlcindy linux vnet ibm com>

When seclabel's type is VIR_DOMAIN_SECLABEL_NONE,
virSecurityLabelDefPtr's members are not allocated.
So it will cause crash when calling VIR_FREE.

This problem is found when running autotest on PPC.

  Failed to remove cgroup for virt-tests-vm1
  *** glibc detected *** /usr/sbin/libvirtd: free(): invalid pointer: 0x00003fff9c187510 ***
  ======= Backtrace: =========

Signed-off-by: Li Zhang <zhlcindy linux vnet ibm com>
  src/conf/domain_conf.c |    2 ++
  1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index f3fca7f..2856660 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -1006,6 +1006,8 @@ virSecurityLabelDefFree(virSecurityLabelDefPtr def)
      if (!def)
+    if (def->type == VIR_DOMAIN_SECLABEL_NONE)
+        return;


As you already found out, we are freeing invalid pointers. We need to
find out root cause. I wonder where those pointers come from, as
VIR_ALLOC(), which is used to alloc a virSecurityLabelDefPtr, fill
allocated memory with zeros, so calling VIR_FREE() even for struct
members is just fine. Are you able to reproduce this crash? What are the

I think it is freed twice.
After the pointer is freed, it will be a wild pointer.
When freeing it the second time, this error occurs.

I am trying to reproduce this crash.
This steps are:
1. start libvirtd
2. create VM
#virsh create /etc/libvirt/qemu/virt-tests-vm1.xml

3. Run autotest tests
#cd /DIR/autotest-power
#./client/autotest-local client/tests/virt/libvirt/control


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]