Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1354549 - lvconvert segfaults when target PV is specified
Summary: lvconvert segfaults when target PV is specified
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: lvm2
Version: 7.3
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Alasdair Kergon
QA Contact: cluster-qe@redhat.com
URL:
Whiteboard:
Depends On:
Blocks: 1353860
TreeView+ depends on / blocked
 
Reported: 2016-07-11 14:18 UTC by Roman Bednář
Modified: 2016-11-04 04:15 UTC (History)
9 users (show)

Fixed In Version: lvm2-2.02.164-4.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 04:15:15 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1445 normal SHIPPED_LIVE lvm2 bug fix and enhancement update 2016-11-03 13:46:41 UTC

Description Roman Bednář 2016-07-11 14:18:09 UTC
Description of problem:
In subject.

How reproducible:
always

Steps to Reproduce:
# lvs -a
  LV                   VG            Attr       LSize   Pool           Origin Data%  Meta%  Move Log Cpy%Sync Convert
  ...                                                          
  [lvol0_pmspare]      vg            ewi-------  12.00m                                                              
  mirror_lv            vg            rwi-a-r---   1.00g                                              100.00          
  [mirror_lv_rimage_0] vg            iwi-aor---   1.00g                                                              
  [mirror_lv_rimage_1] vg            iwi-aor---   1.00g                                                              
  [mirror_lv_rimage_2] vg            iwi-aor---   1.00g                                                              
  [mirror_lv_rmeta_0]  vg            ewi-aor---   4.00m                                                              
  [mirror_lv_rmeta_1]  vg            ewi-aor---   4.00m                                                              
  [mirror_lv_rmeta_2]  vg            ewi-aor---   4.00m                                                              

# lvconvert --yes --splitmirrors 1 --trackchanges vg/mirror_lv /dev/sdf 
Segmentation fault (core dumped)

Actual results:
segfault

Expected results:
command should pass like it does without PV option:

# lvconvert --splitmirrors 1 vg/mirror_lv --name split_test --trackchanges
  mirror_lv_rimage_3 split from mirror_lv for read-only purposes.
  Use 'lvconvert --merge vg/mirror_lv_rimage_3' to merge back into mirror_lv


Additional info:

Valgrind

==13635== LEAK SUMMARY:
==13635==    definitely lost: 0 bytes in 0 blocks
==13635==    indirectly lost: 0 bytes in 0 blocks
==13635==      possibly lost: 0 bytes in 0 blocks
==13635==    still reachable: 1,592,035 bytes in 6,933 blocks
==13635==         suppressed: 0 bytes in 0 blocks
==13635== 
==13635== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==13635== 
==13635== 1 errors in context 1 of 1:
==13635== Invalid read of size 8
==13635==    at 0x1E4C89: lv_raid_split_and_track (in /usr/sbin/lvm)
==13635==    by 0x13AB3E: ??? (in /usr/sbin/lvm)
==13635==    by 0x13D6EE: ??? (in /usr/sbin/lvm)
==13635==    by 0x163335: process_each_lv_in_vg (in /usr/sbin/lvm)
==13635==    by 0x164638: process_each_lv (in /usr/sbin/lvm)
==13635==    by 0x140593: lvconvert (in /usr/sbin/lvm)
==13635==    by 0x14D8E8: lvm_run_command (in /usr/sbin/lvm)
==13635==    by 0x14E48F: lvm2_main (in /usr/sbin/lvm)
==13635==    by 0x5B4EB34: (below main) (in /usr/lib64/libc-2.17.so)
==13635==  Address 0x48 is not stack'd, malloc'd or (recently) free'd
==13635== 
==13635== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault (core dumped)


=====================================
3.10.0-460.el7.x86_64

lvm2-2.02.160-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
lvm2-libs-2.02.160-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
lvm2-cluster-2.02.160-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
device-mapper-1.02.130-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
device-mapper-libs-1.02.130-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
device-mapper-event-1.02.130-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
device-mapper-event-libs-1.02.130-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016
device-mapper-persistent-data-0.6.2-0.1.rc8.el7    BUILT: Wed May  4 09:56:34 CEST 2016
cmirror-2.02.160-1.el7    BUILT: Wed Jul  6 18:16:47 CEST 2016

Comment 2 Heinz Mauelshagen 2016-07-21 17:41:00 UTC
WFM in upstream

Comment 4 Jonathan Earl Brassow 2016-07-28 22:07:21 UTC
confirmed.  definitely fails if you specify a bad PV.

[root@bp-02 ~]# lvs -a -o name,vgname,segtype,devices vg
  LV            VG Type   Devices
  lv            vg raid1  lv_rimage_0(0),lv_rimage_1(0),lv_rimage_2(0)
  [lv_rimage_0] vg linear /dev/sdb1(1)
  [lv_rimage_1] vg linear /dev/sdc1(1)
  [lv_rimage_2] vg linear /dev/sdd1(1)
  [lv_rmeta_0]  vg linear /dev/sdb1(0)
  [lv_rmeta_1]  vg linear /dev/sdc1(0)
  [lv_rmeta_2]  vg linear /dev/sdd1(0)
[root@bp-02 ~]# lvconvert --yes --splitmirrors 1 --trackchanges vg/lv /dev/sde1
Segmentation fault
[root@bp-02 ~]# lvconvert --yes --splitmirrors 1 --trackchanges vg/lv /dev/sdd1
  WARNING: Reading VG vg from disk because lvmetad metadata is invalid.
  lv_rimage_2 split from lv for read-only purposes.
  Use 'lvconvert --merge vg/lv_rimage_2' to merge back into lv



[Note the OP's got some inconsistent information... splitting off mirror_lv_rimage_3 when no such sub-LV existed in the LV.  Suggested likely error from bad input.]

Comment 5 Alasdair Kergon 2016-08-25 22:41:02 UTC
1) If you get a segfault, you should install the debug package and obtain a backtrace from gdb and include that with the bug report.

2) If you find an lvm command goes wrong or doesn't do what you expected, you should run it with -vvvv (or equivalent logging) and include that with the bug report.

That additional information will sometimes be sufficient for us to understand what the problem is and even to fix it.

Comment 6 Alasdair Kergon 2016-08-25 22:46:50 UTC
So in this case we have this backtrace:

(gdb) bt
#0  lv_raid_split_and_track (lv=0x7ffff8327490, splittable_pvs=0x7ffff831df78) at ../../lib/metadata/raid_manip.c:1508
#1  0x00007ffff7e4e34a in _lvconvert_raid (lv=0x7ffff8327490, lp=0x7fffffffd800) at ../../tools/lvconvert.c:1911
#2  0x00007ffff7e5666c in _convert_raid_splitmirrors (cmd=0x7ffff8230170, lv=0x7ffff8327490, lp=0x7fffffffd800) at ../../tools/lvconvert.c:3793
#3  0x00007ffff7e57361 in _convert_raid (cmd=0x7ffff8230170, lv=0x7ffff8327490, lp=0x7fffffffd800) at ../../tools/lvconvert.c:4282
#4  0x00007ffff7e57fb8 in _lvconvert (cmd=0x7ffff8230170, lv=0x7ffff8327490, lp=0x7fffffffd800) at ../../tools/lvconvert.c:4536
#5  0x00007ffff7e58201 in _lvconvert_and_add_to_poll_list (cmd=0x7ffff8230170, lp=0x7fffffffd800, lv=0x7ffff8327490) at ../../tools/lvconvert.c:4591
#6  0x00007ffff7e58514 in _lvconvert_single (cmd=0x7ffff8230170, lv=0x7ffff8327490, handle=0x7ffff8284408) at ../../tools/lvconvert.c:4635
#7  0x00007ffff7e81849 in process_each_lv_in_vg (cmd=0x7ffff8230170, vg=0x7ffff8326b00, arg_lvnames=0x7fffffffd5c0, tags_in=0x7fffffffd750, stop_on_error=0, handle=0x7ffff8284408, 
    process_single_lv=0x7ffff7e58337 <_lvconvert_single>) at ../../tools/toollib.c:2505
#8  0x00007ffff7e82907 in _process_lv_vgnameid_list (cmd=0x7ffff8230170, read_flags=1048576, vgnameids_to_process=0x7fffffffd710, arg_vgnames=0x7fffffffd740, arg_lvnames=0x7fffffffd730, arg_tags=0x7fffffffd750, 
    handle=0x7ffff8284408, process_single_lv=0x7ffff7e58337 <_lvconvert_single>) at ../../tools/toollib.c:2830
#9  0x00007ffff7e83015 in process_each_lv (cmd=0x7ffff8230170, argc=0, argv=0x0, one_vgname=0x7ffff8284430 "vg99", one_lvname=0x7fffffffe01d "lvol0", read_flags=1048576, handle=0x7ffff8284408, 
    process_single_lv=0x7ffff7e58337 <_lvconvert_single>) at ../../tools/toollib.c:2976
#10 0x00007ffff7e58762 in lvconvert (cmd=0x7ffff8230170, argc=2, argv=0x7fffffffdbd0) at ../../tools/lvconvert.c:4681
#11 0x00007ffff7e683f9 in lvm_run_command (cmd=0x7ffff8230170, argc=2, argv=0x7fffffffdbd0) at ../../tools/lvmcmdline.c:1723
#12 0x00007ffff7e69d2d in lvm2_main (argc=6, argv=0x7fffffffdbb0) at ../../tools/lvmcmdline.c:2249
#13 0x00007ffff7e9700c in main (argc=7, argv=0x7fffffffdba8) at ../../tools/lvm.c:22

Comment 7 Alasdair Kergon 2016-08-25 22:51:32 UTC
which takes you straight to this code:

for (s = seg->area_count - 1; s >= 0; --s) {
...
}

if (s >= (int) seg->area_count) {
	log_error("Unable to find image to satisfy request");

where the two things contradict each other: s counts down, not up.

Comment 10 Alasdair Kergon 2016-08-25 23:30:19 UTC
It *is* a regression introduced by commit 9ee071705b2c35e1132f39f5731861c831a1bb6b
which misunderstood some unusual code when applying our policy of not mixing signed and unsigned.  Would have been better to rewrite it more clearly.

Comment 13 Corey Marthaler 2016-09-08 14:42:07 UTC
Fix verified in the latest rpms.

# 7.2 (lvm2-2.02.130-5)

[root@host-128 ~]# lvs -a -o +devices
  LV                        VG    Attr       LSize   Cpy%Sync Devices
  split_tracking            test  rwi-a-r--- 500.00m 100.00   split_tracking_rimage_0(0),split_tracking_rimage_1(0),split_tracking_rimage_2(0)
  [split_tracking_rimage_0] test  iwi-aor--- 500.00m          /dev/sda1(1)
  [split_tracking_rimage_1] test  iwi-aor--- 500.00m          /dev/sda2(1)
  [split_tracking_rimage_2] test  iwi-aor--- 500.00m          /dev/sdb1(1)
  [split_tracking_rmeta_0]  test  ewi-aor---   4.00m          /dev/sda1(0)
  [split_tracking_rmeta_1]  test  ewi-aor---   4.00m          /dev/sda2(0)
  [split_tracking_rmeta_2]  test  ewi-aor---   4.00m          /dev/sdb1(0)

[root@host-128 ~]# lvconvert --yes --splitmirrors 1 --trackchanges test/split_tracking /dev/sde1
Segmentation fault (core dumped)




# latest 7.3 (lvm2-2.02.165-1)

[root@host-127 ~]# lvs -a -o +devices
  LV                        VG          Attr       LSize   Cpy%Sync Devices
  split_tracking            split_image rwi-a-r--- 500.00m 100.00   split_tracking_rimage_0(0),split_tracking_rimage_1(0),split_tracking_rimage_2(0)
  [split_tracking_rimage_0] split_image iwi-aor--- 500.00m          /dev/sdc1(1)
  [split_tracking_rimage_1] split_image iwi-aor--- 500.00m          /dev/sdh1(1)
  [split_tracking_rimage_2] split_image iwi-aor--- 500.00m          /dev/sdd1(1)
  [split_tracking_rmeta_0]  split_image ewi-aor---   4.00m          /dev/sdc1(0)
  [split_tracking_rmeta_1]  split_image ewi-aor---   4.00m          /dev/sdh1(0)
  [split_tracking_rmeta_2]  split_image ewi-aor---   4.00m          /dev/sdd1(0)

[root@host-127 ~]# lvconvert --yes --splitmirrors 1 --trackchanges split_image/split_tracking /dev/sde1
  Unable to find image to satisfy request

Comment 15 errata-xmlrpc 2016-11-04 04:15:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-1445.html


Note You need to log in before you can comment on or make changes to this bug.