On Sun, Aug 02, 2026 at 08:42:05PM +0700, Ross Golder wrote:
When a stream write fails, daemonStreamHandleWriteData() reports the error to the client via virNetServerProgramSendReplyError(), which takes ownership of 'msg' and queues it on client->tx. It then returns that function's return value, which is 0 on success.
Its caller daemonStreamHandleWrite() treats 0 as "the handler did not send anything", so for VIR_NET_CONTINUE it clears the message and queues it a second time to release the client's request slot. As the message is by then the sole element of client->tx, virNetMessageQueuePush() walks to the tail - which is the message itself - and links it to itself. The resulting cycle makes virNetMessageQueueServe() hand out the same pointer twice, and virNetServerClientDispatchWrite() frees it twice:
libvirtd[109078]: free(): invalid pointer systemd[1]: libvirtd.service: Main process exited, code=dumped, status=6/ABRT
The daemon then crash-loops until systemd's start limit is reached.
Note that virNetMessageClear() memsets the whole message, including ->next, so the doubly-queued message looks unlinked and the condition is not detectable by inspecting msg->next alone.
Give the handlers a distinct return value 2, meaning "fully processed and already queued, the caller must not touch msg again", and honour it in daemonStreamHandleWrite(). The requeue test changes from "ret > 0" to "ret == 1" - otherwise the new value would requeue a message which is already on client->tx.
daemonStreamHandleHole() had the identical defect and is fixed the same way. daemonStreamHandleFinish() and daemonStreamHandleAbort() also consume the message, but are only reached for VIR_NET_OK and VIR_NET_ERROR respectively, so the VIR_NET_CONTINUE re-send never applies to them.
Closes: https://gitlab.com/libvirt/libvirt/-/issues/902
Signed-off-by: Ross Golder <ross@golder.org> --- src/remote/remote_daemon_stream.c | 51 +++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 12 deletions(-)
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> thanks for the patch With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|