Bug 2004197

Summary: oc is crashing while mirroring registry
Product: OpenShift Container Platform Reporter: Ross Peoples <rpeoples>
Component: ocAssignee: Ross Peoples <rpeoples>
Status: CLOSED WONTFIX QA Contact: zhou ying <yinzhou>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.2.zCC: aos-bugs, arghosh, cshepher, erich, jokerman, maszulik, mfojtik, yinzhou
Target Milestone: ---Keywords: Reopened
Target Release: 4.6.z   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: An unchecked index operation on a slice when using --max-components argument Consequence: panic: runtime error: slice bounds out of range Fix: Add check to ensure components check doesn't request a value for an index that is out of range Result: When using --max-components argument, oc will no longer panic with an out of range message
 Story Points: ---
Clone Of: 2004194 Environment:
Last Closed: 2021-09-17 14:32:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2004194    
Bug Blocks:    

Description Ross Peoples 2021-09-14 16:52:43 UTC 
+++ This bug was initially created as a clone of Bug #2004194 +++

+++ This bug was initially created as a clone of Bug #2004193 +++

+++ This bug was initially created as a clone of Bug #1786835 +++

Description of problem:

oc client is crashing while creating a mirror registry on AWS

[root@mirror-registry ~]# ./oc adm -a pull-secret1.json release mirror      --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}      --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}      --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}
panic: runtime error: slice bounds out of range

goroutine 45 [running]:
bufio.(*Reader).fill(0xc000c4a840)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/bufio/bufio.go:89 +0x211
bufio.(*Reader).WriteTo(0xc000c4a840, 0x2e12860, 0xc0000106e0, 0x7fec9d675770, 0xc000c4a840, 0x1)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/bufio/bufio.go:511 +0x106
io.copyBuffer(0x2e12860, 0xc0000106e0, 0x2e0d3e0, 0xc000c4a840, 0x0, 0x0, 0x0, 0x0, 0x7961757108000000, 0x2e6f692e)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/io/io.go:384 +0x34e
io.Copy(...)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/io/io.go:364
os/exec.(*Cmd).stdin.func1(0x463911, 0x4d03660)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/os/exec/exec.go:243 +0x67
os/exec.(*Cmd).Start.func1(0xc0010038c0, 0xc0006b7c60)
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/os/exec/exec.go:409 +0x27
created by os/exec.(*Cmd).Start
	/opt/rh/go-toolset-1.12/root/usr/lib/go-toolset-1.12-golang/src/os/exec/exec.go:408 +0x58f



Version-Release number of selected component (if applicable):

openshift-client-linux-4.2.12.tar.gz

How reproducible:

Always

Steps to Reproduce:
1. try to create a mirror registry on an AWS environment
2.
3.

Actual results:
oc is crashing

Expected results:
oc client should run seamlessly

Additional info:

--- Additional comment from Maciej Szulik on 2020-01-02 15:03:13 UTC ---

Can you provide exact steps and full dump of the errors, the current one makes it hard to figure out where and how it failed.

--- Additional comment from Maciej Szulik on 2020-03-13 15:28:34 UTC ---

I haven't heard from the author, thus closing.

--- Additional comment from  on 2021-08-04 21:56:15 UTC ---

Hi there, I believe I need to reopen this bug as I have a customer seeing the same error.

# oc version
Client Version: 4.6.7
Server Version: 4.7.21
Kubernetes Version: v1.20.0+558d959

# oc adm catalog mirror registry.redhat.io/redhat/redhat-operator-index:v4.7 example.com:5000 -a ${REG_CREDS} --insecure --filter-by-os="linux/amd64" --max-components=5
src image has index label for database path: /database/index.db
using database path mapping: /database/index.db:/tmp/861519587
wrote database to /tmp/861519587
using database at: /tmp/861519587/index.db
panic: runtime error: slice bounds out of range [:4] with capacity 2

goroutine 1 [running]:
github.com/openshift/oc/pkg/cli/admin/catalog.mappingForImages(0xc001608390, 0x2fb3672, 0x6, 0x0, 0x0, 0x0, 0x0, 0x7ffc9a2f76ca, 0x1f, 0x7ffc9a2f76ea, ...)
        /go/src/github.com/openshift/oc/pkg/cli/admin/catalog/mirrorer.go:174 +0x12ad
github.com/openshift/oc/pkg/cli/admin/catalog.(*IndexImageMirrorer).Mirror(0xc00049e1e0, 0x3, 0x3, 0xc00049e1e0)
        /go/src/github.com/openshift/oc/pkg/cli/admin/catalog/mirrorer.go:89 +0x148
github.com/openshift/oc/pkg/cli/admin/catalog.(*MirrorCatalogOptions).Run(0xc000f596c0, 0x0, 0x31c6048)
        /go/src/github.com/openshift/oc/pkg/cli/admin/catalog/mirror.go:355 +0x17a
github.com/openshift/oc/pkg/cli/admin/catalog.NewMirrorCatalog.func1(0xc0010aadc0, 0xc000761880, 0x2, 0x7)
        /go/src/github.com/openshift/oc/pkg/cli/admin/catalog/mirror.go:115 +0xbf
github.com/spf13/cobra.(*Command).execute(0xc0010aadc0, 0xc000761810, 0x7, 0x7, 0xc0010aadc0, 0xc000761810)
        /go/src/github.com/openshift/oc/vendor/github.com/spf13/cobra/command.go:846 +0x2c2
github.com/spf13/cobra.(*Command).ExecuteC(0xc0006cf080, 0x2, 0xc0006cf080, 0x2)
        /go/src/github.com/openshift/oc/vendor/github.com/spf13/cobra/command.go:950 +0x375
github.com/spf13/cobra.(*Command).Execute(...)
        /go/src/github.com/openshift/oc/vendor/github.com/spf13/cobra/command.go:887
main.main()
        /go/src/github.com/openshift/oc/cmd/oc/oc.go:110 +0x885


Please let me know what debugging I can provide to troubleshoot this.  Thank you!

--- Additional comment from  on 2021-08-04 22:20:37 UTC ---

Additional note, if we do not use the '--max-components=5', oc does not crash, BUT cu gets a credentials error, even though the same login works with podman.

# oc adm catalog mirror registry.redhat.io/redhat/redhat-marketplace-index:v4.7 example.com:5000 -a ${REG_CREDS} --insecure --filter-by-os="linux/amd64"
src image has index label for database path: /database/index.db
using database path mapping: /database/index.db:/tmp/636075942
wrote database to /tmp/636075942
using database at: /tmp/636075942/index.db

error: unable to retrieve source image registry.marketplace.redhat.com/rhm/cloudhedge/cloud-infra-service manifest sha256:34da7b1c709ba1478ca6cd2fe7d0ecac5f727857c0ade01eaf1144db86377bf0: Get "https://registry.marketplace.redhat.com/v2/rhm/cloudhedge/cloud-infra-service/manifests/sha256:34da7b1c709ba1478ca6cd2fe7d0ecac5f727857c0ade01eaf1144db86377bf0": unauthorized: The login credentials are not valid, or your IBM Cloud account is not active.
error mirroring image: an error occurred during planning

--- Additional comment from OpenShift Automated Release Tooling on 2021-08-12 10:28:39 UTC ---

Elliott changed bug status from MODIFIED to ON_QA.

--- Additional comment from zhou ying on 2021-08-24 11:49:40 UTC ---

can't reproduce with latest oc client:
[root@localhost registry]# oc version --client 
Client Version: 4.9.0-202108192235.p0.git.5622598.assembly.stream-5622598

[root@localhost registry]# oc adm release mirror      --from=quay.io/openshift-release-dev/ocp-release:4.8.6-x86_64  --to=localhost:5000/ocp-index --to-release-image=localhost:5000/ocp-index:48 --insecure
......
To use the new mirrored repository to install, add the following section to the install-config.yaml:

imageContentSources:
- mirrors:
  - localhost:5000/ocp-index
  source: quay.io/openshift-release-dev/ocp-release
- mirrors:
  - localhost:5000/ocp-index
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev


To use the new mirrored repository for upgrades, use the following to create an ImageContentSourcePolicy:

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: example
spec:
  repositoryDigestMirrors:
  - mirrors:
    - localhost:5000/ocp-index
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - localhost:5000/ocp-index
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev

oc adm catalog mirror registry.redhat.io/redhat/redhat-operator-index:v4.7 localhost:5000 --insecure --filter-by-os="linux/amd64" --max-components=5

both run well.

--- Additional comment from errata-xmlrpc on 2021-09-07 08:59:51 UTC ---

This bug has been added to advisory RHEA-2021:81213 by OpenShift Release Team Bot (ocp-build/buildvm.openshift.eng.bos.redhat.com)

--- Additional comment from Eric Rich on 2021-09-14 15:33:01 UTC ---

@rpeoples can this be backported to 4.6?
Comment 1 Maciej Szulik 2021-09-17 14:32:35 UTC 
4.6 is only open for high severity fixes at this point in time.