On Sun, Aug 02, 2026 at 08:42:05PM +0700, Ross Golder wrote: > When a stream write fails, daemonStreamHandleWriteData() reports the > error to the client via virNetServerProgramSendReplyError(), which takes > ownership of 'msg' and queues it on client->tx. It then returns that > function's return value, which is 0 on success. > > Its caller daemonStreamHandleWrite() treats 0 as "the handler did not > send anything", so for VIR_NET_CONTINUE it clears the message and queues > it a second time to release the client's request slot. As the message is > by then the sole element of client->tx, virNetMessageQueuePush() walks to > the tail - which is the message itself - and links it to itself. The > resulting cycle makes virNetMessageQueueServe() hand out the same pointer > twice, and virNetServerClientDispatchWrite() frees it twice: > > libvirtd[109078]: free(): invalid pointer > systemd[1]: libvirtd.service: Main process exited, code=dumped, > status=6/ABRT > > The daemon then crash-loops until systemd's start limit is reached. > > Note that virNetMessageClear() memsets the whole message, including > ->next, so the doubly-queued message looks unlinked and the condition is > not detectable by inspecting msg->next alone. > > Give the handlers a distinct return value 2, meaning "fully processed and > already queued, the caller must not touch msg again", and honour it in > daemonStreamHandleWrite(). The requeue test changes from "ret > 0" to > "ret == 1" - otherwise the new value would requeue a message which is > already on client->tx. > > daemonStreamHandleHole() had the identical defect and is fixed the same > way. daemonStreamHandleFinish() and daemonStreamHandleAbort() also > consume the message, but are only reached for VIR_NET_OK and > VIR_NET_ERROR respectively, so the VIR_NET_CONTINUE re-send never applies > to them. > > Closes: https://gitlab.com/libvirt/libvirt/-/issues/902 > > Signed-off-by: Ross Golder <[email protected]> > --- > src/remote/remote_daemon_stream.c | 51 +++++++++++++++++++++++-------- > 1 file changed, 39 insertions(+), 12 deletions(-)
Reviewed-by: Daniel P. Berrangé <[email protected]> thanks for the patch With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
