openSUSE/wicked — pull request #321 by kmroz (2014-07-15 10:13:18+00:00)
Title: fsm: ensure masterdev has a config node before trying to add children

Fixes a segfault which happens when child->masterdev->config.node == NULL. This wouldn't happen under 'normal' running conditions, but can be triggered in the following unusual scenario with a manually created openvswitch bridge:

i. # ovs-vsctl add-br ovsbr0
- creates ovsbr0 and ovs-system

ii. # ovs-vsctl add-port ovsbr0 enp0s25
- adds ethernet port to newly created openvswitch bridge AND sets ovs-system interface as enp0s25's masterdev

<`ip a` snippet>
2: enp0s25: mtu 1500 qdisc pfifo_fast master ovs-system state UP qlen 1000
<`ip a` snippet>

iii. create ifcfg-ovsbr0 (BRIDGE=yes, etc), and ifcfg-enp0s25

iv. # wicked ifup all
SEGFAULT in /usr/sbin/wicked

Pawel and I found that the crash occurs in xml_node_location() called from ni_iworker_add_child() because the child which we wish to add to parent ovsbr0 has masterdev set to ovs-system (via openvswitch) and ovs-system interface has no config. Points of interest and full stack below:

$7 = 0x20350e0 "ovsbr0"
(gdb) p child->name
$8 = 0x1fe8da0 "enp0s25"
(gdb) p child->masterdev->name
$9 = 0x2034ec0 "ovs-system"
(gdb) p child->masterdev->config.node
$10 = (xml_node_t *) 0x0

(gdb) bt
#0 0x00007f47a107166d in xml_node_location (node=0x0) at xml-reader.c:865
#1 0x00007f47a102991d in ni_ifworker_add_child (parent=0x2035510, child=0x201da10, devnode=0x2052920,
shared=0 '\000') at fsm.c:998
#2 0x00007f47a102d62f in ni_ifworker_netif_resolve_cb (node=0x2052920, type=0x1fefc50, metadata=0x1fefbd0,
user_data=0x7fff473f10b0) at fsm.c:2701
#3 0x00007f47a1022a02 in ni_dbus_validate_xml (node=0x2052920, type=0x1fefc50, ctx=0x7fff473f10c0)
at dbus-xml.c:426
#4 0x00007f47a1023fbe in ni_dbus_validate_xml_dict (node=0x20528a0, type=0x1fef150, ctx=0x7fff473f10c0)
at dbus-xml.c:1030
#5 0x00007f47a1022add in ni_dbus_validate_xml (node=0x20528a0, type=0x1fef150, ctx=0x7fff473f10c0)
at dbus-xml.c:447
#6 0x00007f47a102377c in ni_dbus_validate_xml_array (node=0x2052820, type=0x1ff22e0, ctx=0x7fff473f10c0)
at dbus-xml.c:837
#7 0x00007f47a1022ac4 in ni_dbus_validate_xml (node=0x2052820, type=0x1ff22e0, ctx=0x7fff473f10c0)
at dbus-xml.c:444
#8 0x00007f47a1023fbe in ni_dbus_validate_xml_dict (node=0x2052700, type=0x1ff4a50, ctx=0x7fff473f10c0)
at dbus-xml.c:1030
#9 0x00007f47a1022add in ni_dbus_validate_xml (node=0x2052700, type=0x1ff4a50, ctx=0x7fff473f10c0)
at dbus-xml.c:447
#10 0x00007f47a102247d in ni_dbus_xml_validate_argument (method=0x1fdd9c0, narg=1, node=0x2052700,
ctx=0x7fff473f10c0) at dbus-xml.c:264
#11 0x00007f47a102d2bd in ni_ifworker_bind_early (w=0x2035510, fsm=0x1fdbc30, prompt_now=0 '\000')
at fsm.c:2611
#12 0x00007f47a102d3d2 in ni_fsm_build_hierarchy (fsm=0x1fdbc30, destructive=1 '\001') at fsm.c:2655
#13 0x0000000000410518 in ni_do_ifup_direct (argc=2, argv=0x7fff473f1310) at ifup.c:761
#14 0x000000000041069f in ni_do_ifup (argc=2, argv=0x7fff473f1310) at ifup.c:818
#15 0x000000000041540d in main (argc=3, argv=0x7fff473f1308) at main.c:268