Error during resetPasswordForVirtualMachine

[shwstppr]

problem

Execution of resetPasswordForVirtualMachine fails when no password is provided explicitly.
An error is seen in the API/UI,

While debugging I could obfuscatePassword method is causing the failure https://github.com/apache/cloudstack/blob/main/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java#L340
It wrongly trims the UserVMResponse string resulting in truncated string like,

This causes failure while creating JSON object.

2026-06-10 04:41:39,009 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-5:[ctx-1f56cfeb, job-524]) (logid:4137017f) Unexpected exception while executing org.apache.cloudstack.api.command.admin.vm.ResetVMPasswordCmdByAdmin com.google.gson.JsonSyntaxException: java.io.EOFException: End of input at line 1 column 1390 path $.details.
	at com.google.gson.internal.Streams.parse(Streams.java:59)
	at com.google.gson.JsonParser.parseReader(JsonParser.java:102)
	at com.google.gson.JsonParser.parseReader(JsonParser.java:70)
	at com.google.gson.JsonParser.parseString(JsonParser.java:51)
	at com.google.gson.JsonParser.parse(JsonParser.java:115)
	at com.cloud.utils.HumanReadableJson.addElement(HumanReadableJson.java:60)
	at com.cloud.utils.HumanReadableJson.getHumanReadableBytesJson(HumanReadableJson.java:54)
	at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl.convertHumanReadableJson(AsyncJobManagerImpl.java:430)
	at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl.completeAsyncJob(AsyncJobManagerImpl.java:340)
	at com.cloud.api.ApiAsyncJobDispatcher.runJob(ApiAsyncJobDispatcher.java:113)
	at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl$5.runInContext(AsyncJobManagerImpl.java:698)
	at org.apache.cloudstack.managed.context.ManagedContextRunnable$1.run(ManagedContextRunnable.java:49)
	at org.apache.cloudstack.managed.context.impl.DefaultManagedContext$1.call(DefaultManagedContext.java:56)
	at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.callWithContext(DefaultManagedContext.java:103)
	at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.runWithContext(DefaultManagedContext.java:53)
	at org.apache.cloudstack.managed.context.ManagedContextRunnable.run(ManagedContextRunnable.java:46)
	at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl$5.run(AsyncJobManagerImpl.java:646)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.io.EOFException: End of input at line 1 column 1390 path $.details.
	at com.google.gson.stream.JsonReader.nextNonWhitespace(JsonReader.java:1457)
	at com.google.gson.stream.JsonReader.doPeek(JsonReader.java:503)
	at com.google.gson.stream.JsonReader.hasNext(JsonReader.java:422)
	at com.google.gson.internal.bind.TypeAdapters$28.read(TypeAdapters.java:779)
	at com.google.gson.internal.bind.TypeAdapters$28.read(TypeAdapters.java:725)
	at com.google.gson.internal.Streams.parse(Streams.java:49)
	... 21 more

--Edited--

Root cause is async job result having password field twice, which results in a truncated String passed to JSON. This happens when VM's network VR is not running.
obfuscatePassword method can be improved, and the password detail for the VM can be added with display=false so it doesn't end up in UserVmResponse.

---

versions

4.22.1, KVM Advanced zone but the issue could be preset for other configs as well

The steps to reproduce the bug

1. Deploy a VM with a password enabled template
2. Stop it
3. Make sure VR for the network on which VM is deployed is not running
4. Reset VM password without providing a password

What to do about it?

Fix the isssue

[weizhouapache]

@shwstppr
I tried the steps multiple times, all good. strange

[shwstppr]

@weizhouapache based on m debugging issue occurs when UserVmResponse for the AsyncJob has password field twice, one in root object and once in details. Based on the code I guess it happens when VR is not running. And once the details is added by password reset code, it remains there even after VR is started and subsequent password reset calls are done.

I guess workaround is to remove that password detail for the VM.
To reproduce, maybe you can destroy the VR or add a password detail for the VM

[weizhouapache]

@shwstppr
thanks for the info.
I have reproduced the issue when the VR is stopped.
it also happened when reset vm password with providing the new password

[shwstppr]

Probably password details should be added as display=false

[github-actions]

🏷️ Issue Triaged

Hi @shwstppr! I've categorized this issue as bug based on the following analysis:

Reasoning: The issue reports an unexpected API/UI error when calling resetPasswordForVirtualMachine, traced to a defect in the obfuscatePassword method within AsyncJobManagerImpl. This is a reproducible failure in existing functionality.

View Triage Details

Analysis

• Keywords detected: error, fails, failure, exception, obfuscatePassword, wrong
• Issue type indicators: API call returns an error; stack trace points to a specific method; existing functionality broken
• Confidence: High

Recommended Next Steps

• Review obfuscatePassword in AsyncJobManagerImpl.java around line 340 for the root cause
• Add a regression test covering resetPasswordForVirtualMachine without an explicit password parameter
• Consider checking if other job parameters using obfuscatePassword are similarly affected

References: Triage run §27360995103

Generated by 🔧 Issue Triage Agent · sonnet46 1M · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115