Re: [Xen-devel] bogus libxl error handling in domcreate_bootloader_done

[Olaf Hering <olaf@xxxxxxxxx>]

Am Thu, 28 Feb 2019 14:17:18 +0100
schrieb Olaf Hering <olaf@xxxxxxxxx>:

> In domcreate_bootloader_done, libxl__build_pre is called.
> If that function fails, the label 'out:' is called, which goes straight into 
> domcreate_stream_done. This function uses srs->dcs to set 
> libxl__domain_create_state.
> In my case ->dcs is NULL. The result is a crash in STATE_AO_GC().

A reproducer with staging-4.11:

boot hostA with gnttab_max_frames=256
boot hostB with gnttab_max_frames=512
create domU on hostB with 'xl create -cf "$_"  max_grant_frames=512'
xl migrate domU hostA
migration target: Ready to receive domain.
Saving to migration stream new xl format (info 0x3/0x0/1374)
Loading new save file <incoming migration stream> (new xl fmt info 0x3/0x0/1374)
 Savefile contains xl domain config in JSON format
Parsing config from <saved>
xc: info: Saving domain 1, type x86 PV
libxl: error: libxl_dom.c:363:libxl__build_pre: Couldn't set grant table limits
libxl: error: libxl_utils.c:510:libxl_read_exactly: file/stream truncated 
reading ipc msg header from domain 1 save/restore helper stdout pipe
libxl: error: libxl_exec.c:129:libxl_report_child_exitstatus: domain 1 
save/restore helper [2211] died due to fatal signal Broken pipe
migration sender: libxl_domain_suspend failed (rc=-3)
libxl: info: libxl_exec.c:118:libxl_report_child_exitstatus: migration 
transport process [2209] exited with error status 255
Migration failed, resuming at sender.
xc: error: Dom 1 not suspended: (shutdown 0, reason 255): Internal error
libxl: error: libxl_dom_suspend.c:472:libxl__domain_resume: Domain 
1:xc_domain_resume failed: Invalid argument

Core was generated by `xl -t migrate-receive'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  domcreate_stream_done (egc=0x7ffc81d4d9d0, srs=0x696560, ret=-3) at 
libxl_create.c:1174
1174        STATE_AO_GC(dcs->ao);


(gdb) bt
#0  domcreate_stream_done (egc=0x7ffc81d4d9d0, srs=0x696560, ret=-3) at 
libxl_create.c:1174
#1  0x00007f5fedf3070f in initiate_domain_create (egc=egc@entry=0x7ffc81d4d9d0, 
dcs=dcs@entry=0x694ee0) at libxl_create.c:1005
#2  0x00007f5fedf309c4 in do_domain_create (ctx=ctx@entry=0x0, 
d_config=d_config@entry=0x7ffc81d4dbd0, domid=0x7ffc81d4dad8, 
domid@entry=0x7ffc81d4da08, restore_fd=restore_fd@entry=0, 
    send_back_fd=send_back_fd@entry=1, params=params@entry=0x7ffc81d4db30, 
ao_how=0x0, aop_console_how=0x0) at libxl_create.c:1705
#3  0x00007f5fedf30d8c in libxl_domain_create_restore (ctx=0x0, 
d_config=d_config@entry=0x7ffc81d4dbd0, domid=0x7ffc81d4da08, 
domid@entry=0x7ffc81d4dad8, restore_fd=restore_fd@entry=0, 
    send_back_fd=send_back_fd@entry=1, params=params@entry=0x7ffc81d4db30, 
ao_how=ao_how@entry=0x0, aop_console_how=aop_console_how@entry=0x0) at 
libxl_create.c:1925
#4  0x0000000000420cd6 in create_domain 
(dom_info=dom_info@entry=0x7ffc81d4e0f0) at xl_vmcontrol.c:913
#5  0x0000000000422bdf in migrate_receive (send_fd=1, recv_fd=0, 
userspace_colo_proxy=false, colo_proxy_script=0x0, 
checkpointed=LIBXL_CHECKPOINTED_STREAM_NONE, pause_after_migration=0, 
    monitor=1, daemonize=1, debug=0) at xl_migrate.c:353
#6  main_migrate_receive (argc=<optimized out>, argv=<optimized out>) at 
xl_migrate.c:525
#7  0x0000000000409b1b in main (argc=1, argv=0x7ffc81d4e378) at xl.c:410

(gdb) p dcs
$1 = (libxl__domain_create_state *) 0x0

*srs is all zero.



Olaf

Attachment: pgpG3PlOF4LeQ.pgp
Description: Digitale Signatur von OpenPGP

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel