kern/46824: LVM: LV unable to use 4 stripes

[jym%baaz.fr@localhost]

>Number:         46824
>Category:       kern
>Synopsis:       LVM: LV unable to use 4 stripes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 22 08:50:04 +0000 2012
>Originator:     Jean-Yves Moulin
>Release:        NetBSD-6.0_BETA2 from july, 17 2012
>Organization:
Eileo
>Environment:
NetBSD newdenfert.eileo-local.org 6.0_BETA2 NetBSD 6.0_BETA2 (R410X) #8: Thu 
Aug  2 19:09:07 CEST 2012  
jym%vavin.eileo-local.org@localhost:/usr/src-current/sys/arch/amd64/compile/obj/R410X
 amd64

>Description:
LVM is unable to create a logical volume stripped on 4 disks.

After creating a new filesystem on this volume the volume group is corrupted 
and the 4th physical volume is lost from LVM.


Explanation from Michael L. Hitch:

I believe there is a bug in sys/dev/dm/dm_target_stripe.c.  It has
a fixed size array with 10 elements that it uses to parse the argument string.  
The first two are the "chunk" size and number of stripes.  Each following pair 
are the device name and offset for each stripe.  The problem is that the 
parsing only parses 9 items instead of 10, and the offset on the 4th stripe is 
skipped.
>How-To-Repeat:
* Create a PV on four disks:
# lvm pvcreate /dev/rsd0d
# lvm pvcreate /dev/rsd1d
# lvm pvcreate /dev/rsd2d
# lvm pvcreate /dev/rsd3d

* Create one volume group:
# lvm vgcreate vg00 /dev/rsd0d /dev/rsd1d /dev/rsd2d /dev/rsd3d

* Create one logical volume, stripped accross 4 disks:
# lvm lvcreate -i 4 -L 1G -n test vg00

* Create filesystem:
# newfs /dev/vg00/rtest


* Then, LVM has corrupted one PV:
# lvm pvscan
 Couldn't find device with uuid
'd0f3eX-aGgM-jyDn-Zb78-wWkC-B7AC-e8wAMY'.
 PV /dev/rsd0d       VG vg00   lvm2 [1.82 TiB / 1.82 TiB free]
 PV /dev/rsd1d       VG vg00   lvm2 [1.82 TiB / 1.82 TiB free]
 PV /dev/rsd2d       VG vg00   lvm2 [1.82 TiB / 1.82 TiB free]
 PV unknown device   VG vg00   lvm2 [1.82 TiB / 1.82 TiB free]
 Total: 4 [7.27 TiB] / in use: 4 [7.27 TiB] / in no VG: 0 [0   ]

* dmesg show this:
 Stripe target init function called!!
 Stripe target chunk size 256 number of stripes 4
 Stripe target device name /dev/sd0d -- offset 384
 Stripe target device name /dev/sd1d -- offset 384
 Stripe target device name /dev/sd2d -- offset 384
 Stripe target device name /dev/sd3d -- offset M-kM-5UHM
>Fix:
--- sys/dev/dm/dm_target_stripe.c       4 Jan 2012 16:05:53 -0000 1.17
+++ sys/dev/dm/dm_target_stripe.c       2 Aug 2012 16:57:44 -0000
@@ -128,7 +128,7 @@ dm_target_stripe_init(dm_dev_t * dmv, vo
        * Parse a string, containing tokens delimited by white space,
        * into an argument vector
        */
-       for (ap = argv; ap < &argv[9] &&
+       for (ap = argv; ap <= &argv[9] &&
           (*ap = strsep(&params, " \t")) != NULL;) {
               if (**ap != '\0')
                       ap++;