On Mon, Jul 13, 2026 at 18:13:22 +0100, Daniel Golle wrote:
> qemuAutostartDomain() starts domains with conn=NULL as there is no
> client connection during driver initialisation. Since the managed save
> restore path of qemuDomainObjStart() was switched to
> qemuDomainRestoreInternal(), which obtains the driver by dereferencing
> conn->privateData, any domain with both a managed save image and the
> autostart (or autostart-once) flag crashes virtqemud/libvirtd with
> SIGSEGV on daemon startup.
>
> The session daemon's auto-shutdown feature creates exactly this
> combination on logout with a running VM (auto_shutdown_try_save saves
> the domain and auto_shutdown_restore marks it autostart-once), so the
> first daemon start of every subsequent boot segfaults and clients such
> as GNOME Boxes fail with "Cannot recv data: Connection reset by peer",
> showing an empty machine list.
>
> Pass the driver as an explicit parameter, as qemuDomainObjRestore() did
> before it was merged into qemuDomainRestoreInternal(), and keep @conn
> only for use by the ACL check callbacks, which are not used in the
> autostart code path.
>
> Fixes: 0e2ab427782c ("qemu: driver: Merge 'qemuDomainRestoreInternal' and
> 'qemuDomainObjRestore'")
> Signed-off-by: Daniel Golle <[email protected]>
> ---
> Observed with libvirt 12.5.0 and QEMU 11.0.2 on Arch Linux; the code in
> current git master is identical.
>
> Reproducer (any session domain, regular autostart takes the same path):
>
> $ virsh -c qemu:///session managedsave DOMAIN
> $ virsh -c qemu:///session autostart DOMAIN --once
> # simulate the first daemon start of a boot:
> $ rm "$XDG_RUNTIME_DIR/libvirt/qemu/run/autostarted"
> $ pkill -x virtqemud
> $ virsh -c qemu:///session list --all
> error: failed to connect to the hypervisor
> error: Cannot recv data: Connection reset by peer
>
> Backtrace of the crashing thread (12.5.0, distro debug symbols):
>
> #0 qemuDomainRestoreInternal (conn=conn@entry=0x0, ...)
> at ../src/qemu/qemu_driver.c:5940
> #1 qemuDomainObjStart.constprop.0 (conn=conn@entry=0x0, ...)
> at ../src/qemu/qemu_driver.c:6509
> #2 qemuAutostartDomain at ../src/qemu/qemu_driver.c:185
> #3 virDomainDriverAutoStartOne at ../src/hypervisor/domain_driver.c:700
> #7 virDomainDriverAutoStart at ../src/hypervisor/domain_driver.c:728
> #8 qemuStateInitialize at ../src/qemu/qemu_driver.c:962
> #9 virStateInitialize at ../src/libvirt.c:667
>
> Tested on current master in an isolated session environment with a
> minimal diskless domain: unpatched, the daemon reproducibly segfaults
> on startup after the steps above; patched, it starts cleanly and
> restores the domain from its managed save image. The explicit restore
> APIs (virDomainRestore*) behave as before.
Reviewed-by: Peter Krempa <[email protected]> and pushed.
Thanks for fixing my mistake! :)
