diff --git a/SOURCES/lvm2-2_02_182-metadata-prevent-writing-beyond-metadata-area.patch b/SOURCES/lvm2-2_02_182-metadata-prevent-writing-beyond-metadata-area.patch new file mode 100644 index 0000000..4763114 --- /dev/null +++ b/SOURCES/lvm2-2_02_182-metadata-prevent-writing-beyond-metadata-area.patch @@ -0,0 +1,338 @@ +From 87bd4a350468023b14251b9bde98f88ffb419268 Mon Sep 17 00:00:00 2001 +From: David Teigland +Date: Mon, 29 Oct 2018 11:06:00 -0500 +Subject: [PATCH 2/2] metadata: prevent writing beyond metadata area + +lvm uses a bcache block size of 128K. A bcache block +at the end of the metadata area will overlap the PEs +from which LVs are allocated. How much depends on +alignments. When lvm reads and writes one of these +bcache blocks to update VG metadata, it can also be +reading and writing PEs that belong to an LV. + +If these overlapping PEs are being written to by the +LV user (e.g. filesystem) at the same time that lvm +is modifying VG metadata in the overlapping bcache +block, then the user's updates to the PEs can be lost. + +This patch is a quick hack to prevent lvm from writing +past the end of the metadata area. + +(cherry picked from commit ab27d5dc2a5c3bf23ab8fed438f1542015dc723d) +--- + lib/device/bcache.c | 79 +++++++++++++++++++++++++++++++++++++++++-- + lib/device/bcache.h | 3 ++ + lib/format_text/format-text.c | 10 ++++++ + lib/label/label.c | 35 ++++++++++++++++++- + lib/label/label.h | 2 ++ + lib/metadata/mirror.c | 4 +++ + 6 files changed, 130 insertions(+), 3 deletions(-) + +diff --git a/lib/device/bcache.c b/lib/device/bcache.c +index b1f7d2a..5ac2558 100644 +--- a/lib/device/bcache.c ++++ b/lib/device/bcache.c +@@ -156,6 +156,10 @@ static void _async_destroy(struct io_engine *ioe) + dm_free(e); + } + ++static int _last_byte_fd; ++static uint64_t _last_byte_offset; ++static int _last_byte_sector_size; ++ + static bool _async_issue(struct io_engine *ioe, enum dir d, int fd, + sector_t sb, sector_t se, void *data, void *context) + { +@@ -163,12 +167,53 @@ static bool _async_issue(struct io_engine *ioe, enum dir d, int fd, + struct iocb *cb_array[1]; + struct control_block *cb; + struct async_engine *e = _to_async(ioe); ++ sector_t offset; ++ sector_t nbytes; ++ sector_t limit_nbytes; ++ sector_t extra_nbytes = 0; + + if (((uintptr_t) data) & e->page_mask) { + log_warn("misaligned data buffer"); + return false; + } + ++ offset = sb << SECTOR_SHIFT; ++ nbytes = (se - sb) << SECTOR_SHIFT; ++ ++ /* ++ * If bcache block goes past where lvm wants to write, then clamp it. ++ */ ++ if ((d == DIR_WRITE) && _last_byte_offset && (fd == _last_byte_fd)) { ++ if (offset > _last_byte_offset) { ++ log_error("Limit write at %llu len %llu beyond last byte %llu", ++ (unsigned long long)offset, ++ (unsigned long long)nbytes, ++ (unsigned long long)_last_byte_offset); ++ return false; ++ } ++ ++ if (offset + nbytes > _last_byte_offset) { ++ limit_nbytes = _last_byte_offset - offset; ++ if (limit_nbytes % _last_byte_sector_size) ++ extra_nbytes = _last_byte_sector_size - (limit_nbytes % _last_byte_sector_size); ++ ++ if (extra_nbytes) { ++ log_debug("Limit write at %llu len %llu to len %llu rounded to %llu", ++ (unsigned long long)offset, ++ (unsigned long long)nbytes, ++ (unsigned long long)limit_nbytes, ++ (unsigned long long)(limit_nbytes + extra_nbytes)); ++ nbytes = limit_nbytes + extra_nbytes; ++ } else { ++ log_debug("Limit write at %llu len %llu to len %llu", ++ (unsigned long long)offset, ++ (unsigned long long)nbytes, ++ (unsigned long long)limit_nbytes); ++ nbytes = limit_nbytes; ++ } ++ } ++ } ++ + cb = _cb_alloc(e->cbs, context); + if (!cb) { + log_warn("couldn't allocate control block"); +@@ -179,10 +224,22 @@ static bool _async_issue(struct io_engine *ioe, enum dir d, int fd, + + cb->cb.aio_fildes = (int) fd; + cb->cb.u.c.buf = data; +- cb->cb.u.c.offset = sb << SECTOR_SHIFT; +- cb->cb.u.c.nbytes = (se - sb) << SECTOR_SHIFT; ++ cb->cb.u.c.offset = offset; ++ cb->cb.u.c.nbytes = nbytes; + cb->cb.aio_lio_opcode = (d == DIR_READ) ? IO_CMD_PREAD : IO_CMD_PWRITE; + ++#if 0 ++ if (d == DIR_READ) { ++ log_debug("io R off %llu bytes %llu", ++ (unsigned long long)cb->cb.u.c.offset, ++ (unsigned long long)cb->cb.u.c.nbytes); ++ } else { ++ log_debug("io W off %llu bytes %llu", ++ (unsigned long long)cb->cb.u.c.offset, ++ (unsigned long long)cb->cb.u.c.nbytes); ++ } ++#endif ++ + cb_array[0] = &cb->cb; + do { + r = io_submit(e->aio_context, 1, cb_array); +@@ -1145,3 +1202,21 @@ bool bcache_invalidate_fd(struct bcache *cache, int fd) + + //---------------------------------------------------------------- + ++void bcache_set_last_byte(struct bcache *cache, int fd, uint64_t offset, int sector_size) ++{ ++ _last_byte_fd = fd; ++ _last_byte_offset = offset; ++ _last_byte_sector_size = sector_size; ++ if (!sector_size) ++ _last_byte_sector_size = 512; ++} ++ ++void bcache_unset_last_byte(struct bcache *cache, int fd) ++{ ++ if (_last_byte_fd == fd) { ++ _last_byte_fd = 0; ++ _last_byte_offset = 0; ++ _last_byte_sector_size = 0; ++ } ++} ++ +diff --git a/lib/device/bcache.h b/lib/device/bcache.h +index b0aebb4..cb902ef 100644 +--- a/lib/device/bcache.h ++++ b/lib/device/bcache.h +@@ -158,6 +158,9 @@ bool bcache_write_bytes(struct bcache *cache, int fd, uint64_t start, size_t len + bool bcache_zero_bytes(struct bcache *cache, int fd, uint64_t start, size_t len); + bool bcache_set_bytes(struct bcache *cache, int fd, uint64_t start, size_t len, uint8_t val); + ++void bcache_set_last_byte(struct bcache *cache, int fd, uint64_t offset, int sector_size); ++void bcache_unset_last_byte(struct bcache *cache, int fd); ++ + //---------------------------------------------------------------- + + #endif +diff --git a/lib/format_text/format-text.c b/lib/format_text/format-text.c +index 792d75a..36afba1 100644 +--- a/lib/format_text/format-text.c ++++ b/lib/format_text/format-text.c +@@ -400,10 +400,14 @@ static int _raw_write_mda_header(const struct format_type *fmt, + MDA_HEADER_SIZE - + sizeof(mdah->checksum_xl))); + ++ dev_set_last_byte(dev, start_byte + MDA_HEADER_SIZE); ++ + if (!dev_write_bytes(dev, start_byte, MDA_HEADER_SIZE, mdah)) { ++ dev_unset_last_byte(dev); + log_error("Failed to write mda header to %s fd %d", dev_name(dev), dev->bcache_fd); + return 0; + } ++ dev_unset_last_byte(dev); + + return 1; + } +@@ -677,10 +681,13 @@ static int _vg_write_raw(struct format_instance *fid, struct volume_group *vg, + (unsigned long long)(mdac->rlocn.size - new_wrap), + (unsigned long long)new_wrap); + ++ dev_set_last_byte(mdac->area.dev, mdac->area.start + mdah->size); ++ + if (!dev_write_bytes(mdac->area.dev, mdac->area.start + mdac->rlocn.offset, + (size_t) (mdac->rlocn.size - new_wrap), + fidtc->raw_metadata_buf)) { + log_error("Failed to write metadata to %s fd %d", dev_name(mdac->area.dev), mdac->area.dev->bcache_fd); ++ dev_unset_last_byte(mdac->area.dev); + goto out; + } + +@@ -694,10 +701,13 @@ static int _vg_write_raw(struct format_instance *fid, struct volume_group *vg, + (size_t) new_wrap, + fidtc->raw_metadata_buf + mdac->rlocn.size - new_wrap)) { + log_error("Failed to write metadata wrap to %s fd %d", dev_name(mdac->area.dev), mdac->area.dev->bcache_fd); ++ dev_unset_last_byte(mdac->area.dev); + goto out; + } + } + ++ dev_unset_last_byte(mdac->area.dev); ++ + mdac->rlocn.checksum = calc_crc(INITIAL_CRC, (uint8_t *)fidtc->raw_metadata_buf, + (uint32_t) (mdac->rlocn.size - + new_wrap)); +diff --git a/lib/label/label.c b/lib/label/label.c +index bafa543..d2cfe62 100644 +--- a/lib/label/label.c ++++ b/lib/label/label.c +@@ -172,6 +172,7 @@ int label_write(struct device *dev, struct label *label) + { + char buf[LABEL_SIZE] __attribute__((aligned(8))); + struct label_header *lh = (struct label_header *) buf; ++ uint64_t offset; + int r = 1; + + if (!label->labeller->ops->write) { +@@ -206,11 +207,17 @@ int label_write(struct device *dev, struct label *label) + return 0; + } + +- if (!dev_write_bytes(dev, label->sector << SECTOR_SHIFT, LABEL_SIZE, buf)) { ++ offset = label->sector << SECTOR_SHIFT; ++ ++ dev_set_last_byte(dev, offset + LABEL_SIZE); ++ ++ if (!dev_write_bytes(dev, offset, LABEL_SIZE, buf)) { + log_debug_devs("Failed to write label to %s", dev_name(dev)); + r = 0; + } + ++ dev_unset_last_byte(dev); ++ + return r; + } + +@@ -1256,9 +1263,12 @@ bool dev_write_zeros(struct device *dev, uint64_t start, size_t len) + } + } + ++ dev_set_last_byte(dev, start + len); ++ + if (!bcache_zero_bytes(scan_bcache, dev->bcache_fd, start, len)) { + log_error("Error writing device %s at %llu length %u.", + dev_name(dev), (unsigned long long)start, (uint32_t)len); ++ dev_unset_last_byte(dev); + label_scan_invalidate(dev); + return false; + } +@@ -1266,9 +1276,11 @@ bool dev_write_zeros(struct device *dev, uint64_t start, size_t len) + if (!bcache_flush(scan_bcache)) { + log_error("Error writing device %s at %llu length %u.", + dev_name(dev), (unsigned long long)start, (uint32_t)len); ++ dev_unset_last_byte(dev); + label_scan_invalidate(dev); + return false; + } ++ dev_unset_last_byte(dev); + return true; + } + +@@ -1302,9 +1314,12 @@ bool dev_set_bytes(struct device *dev, uint64_t start, size_t len, uint8_t val) + } + } + ++ dev_set_last_byte(dev, start + len); ++ + if (!bcache_set_bytes(scan_bcache, dev->bcache_fd, start, len, val)) { + log_error("Error writing device %s at %llu length %u.", + dev_name(dev), (unsigned long long)start, (uint32_t)len); ++ dev_unset_last_byte(dev); + label_scan_invalidate(dev); + return false; + } +@@ -1312,9 +1327,27 @@ bool dev_set_bytes(struct device *dev, uint64_t start, size_t len, uint8_t val) + if (!bcache_flush(scan_bcache)) { + log_error("Error writing device %s at %llu length %u.", + dev_name(dev), (unsigned long long)start, (uint32_t)len); ++ dev_unset_last_byte(dev); + label_scan_invalidate(dev); + return false; + } ++ ++ dev_unset_last_byte(dev); + return true; + } + ++void dev_set_last_byte(struct device *dev, uint64_t offset) ++{ ++ unsigned int phys_block_size = 0; ++ unsigned int block_size = 0; ++ ++ dev_get_block_size(dev, &phys_block_size, &block_size); ++ ++ bcache_set_last_byte(scan_bcache, dev->bcache_fd, offset, phys_block_size); ++} ++ ++void dev_unset_last_byte(struct device *dev) ++{ ++ bcache_unset_last_byte(scan_bcache, dev->bcache_fd); ++} ++ +diff --git a/lib/label/label.h b/lib/label/label.h +index 5ed8bc8..e2b8263 100644 +--- a/lib/label/label.h ++++ b/lib/label/label.h +@@ -125,5 +125,7 @@ bool dev_read_bytes(struct device *dev, uint64_t start, size_t len, void *data); + bool dev_write_bytes(struct device *dev, uint64_t start, size_t len, void *data); + bool dev_write_zeros(struct device *dev, uint64_t start, size_t len); + bool dev_set_bytes(struct device *dev, uint64_t start, size_t len, uint8_t val); ++void dev_set_last_byte(struct device *dev, uint64_t offset); ++void dev_unset_last_byte(struct device *dev); + + #endif +diff --git a/lib/metadata/mirror.c b/lib/metadata/mirror.c +index c7d8a9e..b1dcaa0 100644 +--- a/lib/metadata/mirror.c ++++ b/lib/metadata/mirror.c +@@ -302,10 +302,14 @@ static int _write_log_header(struct cmd_context *cmd, struct logical_volume *lv) + return 0; + } + ++ dev_set_last_byte(dev, sizeof(log_header)); ++ + if (!dev_write_bytes(dev, UINT64_C(0), sizeof(log_header), &log_header)) { ++ dev_unset_last_byte(dev); + log_error("Failed to write log header to %s.", name); + return 0; + } ++ dev_unset_last_byte(dev); + + label_scan_invalidate(dev); + +-- +1.8.3.1 + diff --git a/SPECS/lvm2.spec b/SPECS/lvm2.spec index 5eeaa1a..8cd3401 100644 --- a/SPECS/lvm2.spec +++ b/SPECS/lvm2.spec @@ -67,7 +67,7 @@ Summary: Userland logical volume management tools Name: lvm2 Epoch: 7 Version: 2.02.180 -Release: 10%{?dist}.1%{?scratch} +Release: 10%{?dist}.2%{?scratch} License: GPLv2 Group: System Environment/Base URL: http://sources.redhat.com/lvm2 @@ -103,6 +103,7 @@ Patch26: lvm2-2_02_182-scripts-add-After-rbdmap.service-to-lvm2-activation.patch Patch27: lvm2-2_02_182-lvconvert-avoid-superfluous-interim-raid-type.patch Patch28: lvm2-2_02_182-lvconvert-fix-interim-segtype-regression-on-raid6-co.patch Patch29: lvm2-2_02_182-fix-clustered-mirror-repair.patch +Patch30: lvm2-2_02_182-metadata-prevent-writing-beyond-metadata-area.patch BuildRequires: libselinux-devel >= %{libselinux_version}, libsepol-devel BuildRequires: libblkid-devel >= %{util_linux_version} @@ -185,6 +186,7 @@ or more physical volumes and creating one or more logical volumes %patch27 -p1 -b .avoid_superfluous_raid_conversion %patch28 -p1 -b .fix_interim_segtype_on_raid6 %patch29 -p1 -b .fix_clvmd_mirror +%patch30 -p1 -b .prevent_writing_beyond_MDA %build %global _default_pid_dir /run @@ -932,7 +934,7 @@ the device-mapper event library. %package -n %{boom_pkgname} Summary: %{boom_summary} Version: %{boom_version} -Release: %{boom_release}%{?dist}.1%{?scratch} +Release: %{boom_release}%{?dist}.2%{?scratch} License: GPLv2 Group: System Environment/Base BuildArch: noarch @@ -963,6 +965,9 @@ This package provides the python2 version of boom. %endif %changelog +* Wed Oct 31 2018 Marian Csontos - 7:2.02.180-10.el7_6.2 +- Fix possible write beyond metadata area. + * Wed Oct 10 2018 Marian Csontos - 7:2.02.180-10.el7_6.1 - Fix clustered mirror repair.