[metadata] uninitialized members in struct pv_list

[mingnus]

Scenario: Given an existed LV lvol0, I want to create another LV on the PVs used by lvol0

I use build_parallel_areas_from_lv() to obtain the pv_list of each segments. However, the returned pv_list is not properly initialized, which causes segfault in subsequent operations.

Here's the patch:

diff --git a/lib/metadata/lv_manip.c b/lib/metadata/lv_manip.c
index 2c569d8f9..27c40d710 100644
--- a/lib/metadata/lv_manip.c
+++ b/lib/metadata/lv_manip.c
@@ -5962,7 +5962,7 @@ static int _add_pvs(struct cmd_context *cmd, struct pv_segment *peg,
        if (find_pv_in_pv_list(&spvs->pvs, peg->pv))
                return 1;
 
-       if (!(pvl = dm_pool_alloc(cmd->mem, sizeof(*pvl)))) {
+       if (!(pvl = dm_pool_zalloc(cmd->mem, sizeof(*pvl)))) {
                log_error("pv_list allocation failed");
                return 0;
        }

[zkabelac]

Dne 14. 12. 18 v 10:51 Ming-Hung Tsai napsal(a):

Scenario: Given an existed LV |lvol0|, I want to create another LV on the PVs used by |lvol0| I use |build_parallel_areas_from_lv()| to obtain the |pv_list| of each segments. However, the returned |pv_list| is not properly initialized, which causes segfault in subsequent operations. Here's the patch: |diff --git a/lib/metadata/lv_manip.c b/lib/metadata/lv_manip.c index 2c569d8f9..27c40d710 100644 --- a/lib/metadata/lv_manip.c +++ b/lib/metadata/lv_manip.c @@ -5962,7 +5962,7 @@ static int _add_pvs(struct cmd_context *cmd, struct pv_segment *peg, if (find_pv_in_pv_list(&spvs->pvs, peg->pv)) return 1; - if (!(pvl = dm_pool_alloc(cmd->mem, sizeof(*pvl)))) { + if (!(pvl = dm_pool_zalloc(cmd->mem, sizeof(*pvl)))) { log_error("pv_list allocation failed"); return 0; } |

Hi Thanks for noticing, pushed upstream. Zdenek

[mingnus]

Thanks. Could you help backport to the 2018-06-01-stable branch, please?

[csonto]

Done. Thank you!

[wangwang3210]

@mingnus could you tell me how to reproduce the segmentfault issue, I run
lvcreate -i 2 -L 30G -n lv1 vg
lvcreate -i 2 -L 30G -n lv2 vg
, while build_parallel_areas_from_lv is not called, segfault does not occur neither.
thanks a lot!

[mingnus]

@wangwang3210
It's a "potential" bug, and cannot be reproduced via command line. I found it while I was modifying the code.