Bug 557104 - dmeventd crash if both snapshot and mirror monitoring DSO are used
dmeventd crash if both snapshot and mirror monitoring DSO are used
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: lvm2 (Show other bugs)
All Linux
high Severity high
: rc
: ---
Assigned To: Petr Rockai
Cluster QE
Depends On:
  Show dependency treegraph
Reported: 2010-01-20 07:46 EST by Milan Broz
Modified: 2013-02-28 23:09 EST (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-03-30 05:01:34 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Milan Broz 2010-01-20 07:46:44 EST
Description of problem:

Unsafe lvm2lib initialisation between two plugins cause memory corruption and dmeventd crash.

Version-Release number of selected component (if applicable):


How reproducible:

1) run dmeventd in foreground mode "dmeventd -d" 

2)create VG with two mirrors and two snapshots, e.g.

# lvs vg_bar
  LV     VG     Attr   LSize Origin Snap%  Move Log        Copy%  Convert
  lv1    vg_bar owi-a- 4.00M
  lv1_s1 vg_bar swi-a- 4.00M lv1      0.20
  lv1_s2 vg_bar swi-a- 4.00M lv1      0.20
  lv2m   vg_bar mwi-a- 4.00M                    lv2m_mlog  100.00
  lv2m2  vg_bar mwi-a- 4.00M                    lv2m2_mlog 100.00

3) Activate and deactivate all volumes:
while :; do vgchange -a n vg_bar ; vgchange -a y vg_bar ; done

4) Enjoy the crash
# dmeventd -d     
You have a memory leak (not released memory pool):
device-mapper: waitevent ioctl failed: Interrupted system call
You have a memory leak (not released memory pool):            
*** glibc detected *** dmeventd: realloc(): invalid next size: 0x09a73710 ***
======= Backtrace: =========                                                 

Expected results:

lvm2_init and lvm2_exit (and internal constructors/destructors) must use some kind od reference counting or globally allocated structs must be moved into command context.
Comment 2 Milan Broz 2010-01-27 08:40:49 EST
Fix in upstream cvs -> POST.
Comment 3 Milan Broz 2010-01-27 10:01:53 EST
Patch in lvm2-2_02_56-6_el5.
Comment 6 Corey Marthaler 2010-02-03 17:11:08 EST
Is this message still expected in the latest rpms?

device-mapper: waitevent ioctl failed: Interrupted system call
Comment 7 Corey Marthaler 2010-02-03 17:30:10 EST
The segfault in this bug is verified fixed in lvm2-2.02.56-6.el5. I also verified that multiple VGs containing multiple snaps/mirrors also works.

Waiting to put this into the VERIFIED state until the question in comment #6 is answered.
Comment 8 Milan Broz 2010-02-04 04:53:00 EST
(In reply to comment #6)
> device-mapper: waitevent ioctl failed: Interrupted system call    

yes, it is expected.
dmeventd has one thread per monitored device, every thread waits for event (in dm-ioctl syscall). If the device is removed waiting is interrupted.
This warning should be probably more quite (like debug level only) but it is just cosmetic change.
Comment 10 errata-xmlrpc 2010-03-30 05:01:34 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.