From: Michal Privoznik <[email protected]>
When parsing disk source in ESX driver (esxParseVMXFileName())
the datastore is traversed through trying to find matching
prefix. But not every datastore has to be mounted. In that case,
esxVI_LookupDatastoreHostMount() returns success and the returned
struct has mountInfo->path set to NULL. This can be deducted from
the following backtrace (which shows that strlen() hidden in
STRSKIP() macro was given NULL pointer).
Thread 1 "virsh" received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
76 VPCMPEQ (%rdi), %ymm0, %ymm1
(gdb) bt full
#0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
No locals.
#1 0x00007ffff7c292d7 in esxParseVMXFileName (fileName=0x5555557341d0
"/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk",
opaque=0x7fffffffcf80,
out=0x7fffffffc738, allow_missing=false) at ../src/esx/esx_driver.c:172
data = 0x7fffffffcf80
propertyNameList = 0x555555738b50
datastoreList = 0x55555573cf40
datastore = <optimized out>
hostMount = 0x555555733640
datastoreName = 0x55555573e590 "mnecas-nfs-test"
tmp = <optimized out>
saveptr = 0x5555556a5b50 ""
strippedFileName = 0x0
copyOfFileName = 0x0
directoryAndFileName = <optimized out>
ret = -1
__FUNCTION__ = "esxParseVMXFileName"
#2 0x00007ffff7bd47f4 in virVMXParseDisk (ctx=ctx@entry=0x7fffffffcfb0,
xmlopt=xmlopt@entry=0x555555738d80, conf=conf@entry=0x5555556a5b50,
device=device@entry=0, busType=<optimized out>, busType@entry=3,
controllerOrBus=controllerOrBus@entry=1, unit=<optimized out>,
def=0x7fffffffc960, vmdef=0x5555557375a0) at ../src/vmx/vmx.c:2553
tmp = 0x0
result = -1
prefix = 0x5555557384d0 "scsi1:0"
present_name = "scsi1:0.present", '\000' <repeats 16 times>
present = true
startConnected_name =
"scsi1:0.startConnected\000\000\000\000\000\000\000\000\000"
startConnected = true
deviceType_name = "scsi1:0.deviceType", '\000' <repeats 13 times>
deviceType = 0x555555737f60 "scsi-hardDisk"
clientDevice_name = "scsi1:0.clientDevice", '\000' <repeats 11 times>
clientDevice = false
fileType_name = "scsi1:0.fileType", '\000' <repeats 15 times>
fileType = 0x0
fileName_name = "scsi1:0.fileName", '\000' <repeats 15 times>
fileName = 0x5555557341d0
"/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk"
writeThrough_name = "scsi1:0.writeThrough", '\000' <repeats 11 times>
writeThrough = false
mode_name = "scsi1:0.mode", '\000' <repeats 19 times>
mode = 0x0
cleanup = <optimized out>
__FUNCTION__ = "virVMXParseDisk"
#3 0x00007ffff7bd5f01 in virVMXParseConfig (ctx=0x7fffffffcfb0,
xmlopt=0x555555738d80, caps=<optimized out>, vmx=<optimized out>) at
../src/vmx/vmx.c:1749
#4 0x00007ffff7c35319 in esxDomainGetXMLDesc (domain=<optimized out>, flags=0)
at ../src/esx/esx_driver.c:2595
#5 0x00007ffff7cc4fd3 in virDomainGetXMLDesc
(domain=domain@entry=0x5555557367f0, flags=flags@entry=0) at
../src/libvirt-domain.c:2898
#6 0x0000555555586cca in cmdDumpXML (ctl=0x7fffffffd1d0, cmd=0x5555556a5450)
at ../tools/virsh-domain.c:10787
#7 0x00005555555bc7cb in vshCommandRun (ctl=0x7fffffffd1d0,
cmd=0x5555556a5450) at ../tools/vsh.c:1383
#8 0x0000555555562fbc in main (argc=<optimized out>, argv=0x7fffffffd5c8) at
../tools/virsh.c:900
The backtrace was trimmed.
To fix this, just check whether mount path is not NULL before
passing it to STRSKIP().
Resolves: https://redhat.atlassian.net/browse/RHEL-213506
Signed-off-by: Michal Privoznik <[email protected]>
---
BTW: this crasher is easily reproducible with our test suite too. Just
comment line 49 in tests/vmx2xmlmock.c file and run vmx2xmltest.
src/esx/esx_driver.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c
index c5b3fa47b6..75bbd07750 100644
--- a/src/esx/esx_driver.c
+++ b/src/esx/esx_driver.c
@@ -169,6 +169,9 @@ esxParseVMXFileName(const char *fileName,
goto cleanup;
}
+ if (!hostMount->mountInfo->path)
+ continue;
+
tmp = (char *)STRSKIP(fileName, hostMount->mountInfo->path);
if (!tmp)
--
2.54.0
