[linux-lvm] vgchange --deltag core dump

[John DeFranco]

Hi all,

During a test I am running I have vary rarely encountered the following 
vgchange core dump. I see no other errors on the system. The dump seems
pretty obvious we tried to do a strncpy from an illegal address (p->tb)
but I don't know how that would have occured. The vg is not being 
touched and we have run a vgchange set of command (--addtag,  -a y,
-a n, --deltag) many, many times prior to this and again after. Seems
like something is going on that I don't quite understand.

This is on rh4U2 ipf and the following lvm version
(but have seen this same problem on other archs as well). I did build
a debug version of the tools which were used in an attempt to get more
data.

[root at boil pkg-2346_6]# uname -a
Linux boil.cup.hp.com 2.6.9-22.EL #1 SMP Mon Sep 19 17:54:55 EDT 2005 
ia64 ia64 ia64 GNU/Linux
[root at boil pkg-2346_6]# cat /etc/redhat-release
Red Hat Enterprise Linux ES release 4 (Nahant Update 2)
[root at boil pkg-2346_6]# lvm version
   LVM version:     2.01.14 (2005-08-04)
   Library version: 1.01.04 (2005-08-02)
   Driver version:  4.4.0
[root at boil pkg-2346_6]#

[root at boil vgchange]# gdb vgchange core.1
GNU gdb Red Hat Linux (6.3.0.0-1.63rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "ia64-redhat-linux-gnu"...Using host 
libthread_db lib
rary "/lib/tls/libthread_db.so.1".

Reading symbols from shared object read from target memory...done.
Loaded system supplied DSO at 0xa000000000000000
Core was generated by `vgchange --deltag boil.cup.hp.com vgsb4'.
Program terminated with signal 7, Bus error.

warning: svr4_current_sos: Can't read pathname for load map: 
Input/output error

Reading symbols from /lib/libdevmapper.so.1.01...done.
Loaded symbols for /lib/libdevmapper.so.1.01
Reading symbols from /lib/libselinux.so.1...done.
Loaded symbols for /lib/libselinux.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/tls/libc.so.6.1...done.
Loaded symbols for /lib/tls/libc.so.6.1
Reading symbols from /lib/ld-linux-ia64.so.2...done.
Loaded symbols for /lib/ld-linux-ia64.so.2
#0  0x2000000000196870 in strncpy () from /lib/tls/libc.so.6.1
(gdb) bt
#0  0x2000000000196870 in strncpy () from /lib/tls/libc.so.6.1
#1  0x400000000006f420 in _dup_tok (p=0x600000000002c1f0)
     at config/config.c:711
#2  0x400000000006d8d0 in _type (p=0x600000000002c1f0) at 
config/config.c:524
#3  0x400000000006d150 in _value (p=0x600000000002c1f0) at 
config/config.c:468
#4  0x400000000006cf40 in _section (p=0x600000000002c1f0)
     at config/config.c:452
#5  0x400000000006ccb0 in _section (p=0x600000000002c1f0)
     at config/config.c:438
#6  0x400000000006c860 in _file (p=0x600000000002c1f0) at 
config/config.c:405
#7  0x400000000006b050 in read_config_fd (cft=0x600000000002c1a8,
     dev=0x60000000000301d8, offset=0, size=629, offset2=0, size2=0,
     checksum_fn=0, checksum=0) at config/config.c:191
#8  0x400000000006b7f0 in read_config_file (cft=0x600000000002c1a8)
     at config/config.c:248
#9  0x4000000000084d30 in persistent_filter_load (f=0x600000000002c0b8)
     at filters/filter-persistent.c:109
#10 0x4000000000066be0 in _init_filters (cmd=0x6000000000011278)
     at commands/toolcontext.c:609
#11 0x4000000000068fd0 in create_toolcontext (the_args=0x6000000000000ff0)
     at commands/toolcontext.c:951
#12 0x4000000000023c70 in _init_lvm () at lvmcmdline.c:945
#13 0x4000000000024c00 in lvm2_main (argc=4, argv=0x60000fffffffbaf8,
---Type <return> to continue, or q <return> to quit---
     is_static=0) at lvmcmdline.c:1376
#14 0x400000000005a580 in main ()
(gdb) fr 1
#1  0x400000000006f420 in _dup_tok (p=0x600000000002c1f0)
     at config/config.c:711
711             strncpy(str, p->tb, len);
(gdb) print str
$1 = 0x600000000002c390 
"¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º¾º"...
(gdb) print p->tb
$2 = 0x200000000345409d <Address 0x200000000345409d out of bounds>
(gdb) print len
$3 = 9
(gdb)

-- 
===========
John DeFranco                  Hewlett Packard Company
john.defranco at hp.com           Availability Clusters Solution Lab
phone: 408 447-7543            19111 Pruneridge Ave., M/S 4101
fax:   408 447-0056            Cupertino, CA 95014