Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-54271

buffer overflow detected during 'sanlock direct dump'

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.5
    • rhel-9.5
    • sanlock
    • None
    • sanlock-3.9.3-2.el9
    • Yes
    • Moderate
    • sst_logical_storage
    • ssg_filesystems_storage_and_HA
    • 24
    • 31
    • 2
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • x86_64
    • None

      kernel-5.14.0-490.el9    BUILT: Fri Aug  2 10:42:23 PM CEST 2024
      sanlock-3.9.3-1.el9    BUILT: Thu May 16 05:55:55 PM CEST 2024
      sanlock-lib-3.9.3-1.el9    BUILT: Thu May 16 05:55:55 PM CEST 2024
       
       
      SCENARIO - [attempt_to_overwrite_extents_beyond_metadata]
      Create an origin on a VG with limited and non default metadata and then attempt to overfill it while writing to the area near it using a sanlock process
      Installing package sanlock on virt-497.cluster-qe.lab.eng.brq.redhat.com...
      Package sanlock installed on node virt-497.cluster-qe.lab.eng.brq.redhat.com.
      Recreating PVs/VG with smaller non default VG metadata size
      pvcreate --dataalignment 128k --metadatasize 256k /dev/sdh1
      WARNING: Heartbeat did not respond at start of command.  Check btimed service on remote host
        WARNING: adding device /dev/sdh1 with idname naa.6001405986a09fef17f4a5aad783380a which is already used for /dev/sdh.
      virt-497.cluster-qe.lab.eng.brq.redhat.com: vgcreate --config devices/default_data_alignment=0 --metadatasize 520k snapper /dev/sdh1
        WARNING: adding device /dev/sdh1 with idname naa.6001405986a09fef17f4a5aad783380a which is already used for /dev/sdh.
      Create a lv at the address space directly after the vg MDA area to be used and monitored by sanlock during this test
      lvcreate --yes -n sanlock_monitor -l 2 snapper
      Shutting down any prior running sanlock (sanlock shutdown)
      systemctl start sanlock
      sanlock client init -s LS:0:/dev/snapper/sanlock_monitor:0 -o 2
      WARNING: Heartbeat did not respond at start of command.  Check btimed service on remote host
      sanlock client add_lockspace -s LS:1:/dev/snapper/sanlock_monitor:0 -o 2
      WARNING: Heartbeat did not respond at start of command.  Check btimed service on remote host
      add_lockspace_timeout 2
      add_lockspace_timeout done 0
       
      Quick pseudo check for bug 1827220
      sanlock direct dump /dev/snapper/sanlock_monitor:0:1M
      *** buffer overflow detected ***: terminated
      sanlock direct dump failed
       
       
      Aug 14 14:11:47 virt-497 qarshd[2839]: Running cmdline: sanlock client init -s LS:0:/dev/snapper/sanlock_monitor:0 -o 2
      Aug 14 14:11:48 virt-497 systemd[1]: qarshd@23-10.37.165.145:5016-10.22.65.33:36816.service: Deactivated successfully.
      Aug 14 14:11:48 virt-497 systemd[1]: Started qarsh Per-Connection Server (10.22.65.33:36818).
      Aug 14 14:11:48 virt-497 qarshd[2868]: Talking to peer ::ffff:10.22.65.33:36818 (IPv6)
      Aug 14 14:11:50 virt-497 qarshd[2868]: Running cmdline: sanlock client add_lockspace -s LS:1:/dev/snapper/sanlock_monitor:0 -o 2
      Aug 14 14:11:50 virt-497 wdmd[2808]: /dev/watchdog0 open with timeout 60
      Aug 14 14:11:58 virt-497 systemd[1]: qarshd@24-10.37.165.145:5016-10.22.65.33:36818.service: Deactivated successfully.
      Aug 14 14:11:58 virt-497 systemd[1]: Started qarsh Per-Connection Server (10.22.65.33:36830).
      Aug 14 14:11:58 virt-497 qarshd[2898]: Talking to peer ::ffff:10.22.65.33:36830 (IPv6)
      Aug 14 14:11:59 virt-497 qarshd[2898]: Running cmdline: sanlock direct dump /dev/snapper/sanlock_monitor:0:512M
      Aug 14 14:11:59 virt-497 systemd[1]: Created slice Slice /system/systemd-coredump.
      Aug 14 14:11:59 virt-497 systemd[1]: Started Process Core Dump (PID 2921/UID 0).
      Aug 14 14:11:59 virt-497 systemd-coredump[2922]: Process 2899 (sanlock) of user 179 dumped core.#012#012Stack trace of thread 2899:#012#0  0x00007fa07168b94c __pthread_kill_implementation (libc.so.6 + 0x8b94c)#012#1  0x00007fa07163e646 raise (libc.so.6 + 0x3e646)#012#2  0x00007fa0716287f3 abort (libc.so.6 + 0x287f3)#012#3  0x00007fa071629130 __libc_message.cold (libc.so.6 + 0x29130)#012#4  0x00007fa07171d77b __fortify_fail (libc.so.6 + 0x11d77b)#012#5  0x00007fa07171c0e6 __chk_fail (libc.so.6 + 0x11c0e6)#012#6  0x00007fa07171b9e6 __strcpy_chk (libc.so.6 + 0x11b9e6)#012#7  0x00005600a946e85f strcpy (sanlock + 0xf85f)#012#8  0x00005600a947eafb do_direct (sanlock + 0x1fafb)#012#9  0x00005600a94675e2 main (sanlock + 0x85e2)#012#10 0x00007fa071629590 __libc_start_call_main (libc.so.6 + 0x29590)#012#11 0x00007fa071629640 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29640)#012#12 0x00005600a9469135 _start (sanlock + 0xa135)#012ELF object binary architecture: AMD x86-64
       
       
       
       
      Core was generated by `sanlock direct dump /dev/snapper/sanlock_monitor:0:512M'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
      44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
      (gdb) bt
      #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
      #1  0x00007fa07168b9b3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
      #2  0x00007fa07163e646 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
      #3  0x00007fa0716287f3 in __GI_abort () at abort.c:79
      #4  0x00007fa071629130 in __libc_message (fmt=fmt@entry=0x7fa0717bb45f "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
      #5  0x00007fa07171d77b in __GI___fortify_fail (msg=msg@entry=0x7fa0717bb405 "buffer overflow detected") at fortify_fail.c:24
      #6  0x00007fa07171c0e6 in __GI___chk_fail () at chk_fail.c:28
      #7  0x00007fa07171b9e6 in __strcpy_chk (dest=dest@entry=0x7ffd6a00e260 "", 
          src=src@entry=0x7ffd6a00e3d8 "e5e3c678-2f94-4dd1-b0e7-10ff95c027c6.virt-497.clP\004", destlen=destlen@entry=49) at strcpy_chk.c:30
      #8  0x00005600a946e85f in strcpy (__src=0x7ffd6a00e3d8 "e5e3c678-2f94-4dd1-b0e7-10ff95c027c6.virt-497.clP\004", __dest=0x7ffd6a00e260 "")
          at /usr/include/bits/string_fortified.h:79
      #9  direct_dump (task=0x5600a95a42c0 <main_task>, dump_path=<optimized out>, force_mode=0)
          at /usr/src/debug/sanlock-3.9.3-1.el9.x86_64/src/direct.c:734
      #10 0x00005600a947eafb in do_direct () at /usr/src/debug/sanlock-3.9.3-1.el9.x86_64/src/main.c:3905
      #11 0x00005600a94675e2 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/sanlock-3.9.3-1.el9.x86_64/src/main.c:4133
      

            teigland@redhat.com David Teigland
            cmarthal@redhat.com Corey Marthaler
            David Teigland David Teigland
            Cluster QE Cluster QE
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: