Bug 177031
| Summary: | device-mapper mirror log: avoid overrun while syncing | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Alasdair Kergon <agk> | ||||
| Component: | kernel | Assignee: | Alasdair Kergon <agk> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 4.3 | CC: | coughlan, jbaron, jbrassow, tburke | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | RHSA-2006-0132 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2006-03-07 21:08:46 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 168430 | ||||||
| Attachments: |
|
||||||
Created attachment 122833 [details]
dm-log-fix-resync-device-limit.patch
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0132.html |
The initial sync performed when creating a mirror can overrun the end of the mapped sections of the underlying devices, corrupting data that doesn't belong to device-mapper. do { *region = find_next_zero_bit((unsigned long *) lc->sync_bits, lc->region_count, lc->sync_search); lc->sync_search = *region + 1; if (*region == lc->region_count) return 0; } while (log_test_bit(lc->recovering_bits, *region)); log_set_bit(lc, lc->recovering_bits, *region); If every bit up to lc->sync_bits is 1 (easily reproduced by setting the 'nosync' option which is not supposed to do any syncing) *region gets set to a value that exceeds lc->region_count and you see 'attempt to access beyond end of device' errors.