Bug 2238197

Summary: integer overflow in _fs_reduce newsize_bytes_lv calculation
Product: [Community] LVM and device-mapper Reporter: xiaoliniess
Component: lvm2Assignee: LVM Team <lvm-team>
lvm2 sub component: liblvm2cmd QA Contact: cluster-qe <cluster-qe>
Status: CLOSED NEXTRELEASE Docs Contact:
Severity: medium    
Priority: unspecified CC: agk, heinzm, jbrassow, msnitzer, prajnoha, tasleson, teigland, zkabelac
Version: unspecifiedFlags: pm-rhel: lvm-technical-solution?
pm-rhel: lvm-test-coverage?
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-09-11 17:22:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description xiaoliniess 2023-09-10 03:17:01 UTC
Description of problem:
when run lv reduce on large lv, lvreduce incorrectly reported size not enough when there is enough size for fs

# lvresize -L-1G /dev/vg_coldbackup/lv_coldbackup_encrypted 
  Checking crypt device /dev/dm-6 on LV vg_coldbackup/lv_coldbackup_encrypted.
  File system size 485314527232b is adjusted for crypt data offset 16777216b.
  File system ext4+crypto_LUKS found on vg_coldbackup/lv_coldbackup_encrypted mounted at /run/media/iess/coldbackup.
  File system size (2.25 TiB) is larger than the requested size (451.98 GiB).
  File system reduce is required (see resize2fs or --resizefs.)

Version-Release number of selected component (if applicable):
lvm2 v2_03_17
commit 264827cb98458f7100456eeebf7fdde8dcbc0ad4

How reproducible:
always

Steps to Reproduce:
1. create a large enough lv, make sure lp->extents * lv->vg->extent_size overflow uint32
2. create an ext4 file system on lv, and reduce its size a little (leaving room to shrink lv)
3. run lvreduce to shrink the lv near the underlying file system size

Actual results:
lvreduce report requested size not match requested size, and less than the file system size, refuse to reduce

Expected results:
lv successfully reduced to requested size

Additional info:
in _fs_reduce() function
newsize_bytes_lv = lp->extents * lv->vg->extent_size * SECTOR_SIZE;
the extents and extent_size are all uint32, when lv large enough, the first multiple will overflow and produce incorrect result

Comment 1 David Teigland 2023-09-11 17:22:17 UTC
Thanks for the report.
fixed in https://gitlab.com/lvmteam/lvm2/-/commit/fa496513010976aac21584b5081529b76462f9a9