grub-probe can't probe large logical volumes (LVM)

Bug #1475337 reported by Rarylson Freitas
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
grub
Unknown
Unknown
grub2 (Ubuntu)
Fix Released
Undecided
Unassigned
Precise
Won't Fix
Undecided
Unassigned

Bug Description

Hi,

I've had a problem when using the `grub-probe` binary to probe large LVM partitions (for example, a 1.5 TB partition).

This problem was discovered/tested in an Ubuntu 12.04.5.

When trying to probe these large LVM partitions, we get erros like:

    $ grub-probe -vvv /PATH/TO/MY/LVM
    [...]
    grub-core/kern/disk.c:494: Read out of range: sector 0x0 (out of disk).
    [...]
    grub-probe: error: unknown filesystem.

This bug seems like this one: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1027363

So, a debug the problem and I discovered that the problem occurs due to an inappropriate multiplication in the file grub-core/disk/lvm.c:

    lv->size += seg->extent_count * vg->extent_size;

The lv->size var is an unsigned 64-bits integer. However, the next two vars are respectively an unsigned int and an int. As the result of (unsigned int) * (int) is an integer, it's very easy to get a multiplication overflow (in my case, the result of the multiplication was zero -> lv->size = 0, resulting in the "out of disk" error).

So, I'm proposing a patch for this bug (file lvm_big_size.patch, to be applied after all Debian patched):

    Index: grub2-1.99/grub-core/disk/lvm.c
    ===================================================================
    --- grub2-1.99.orig/grub-core/disk/lvm.c 2011-04-18 21:16:16.000000000 +0000
    +++ grub2-1.99/grub-core/disk/lvm.c 2015-07-16 03:05:41.624035502 +0000
     -629,7 +629,8 @@
           goto lvs_segment_fail;
         p += sizeof("type = \"") - 1;

    - lv->size += seg->extent_count * vg->extent_size;
    + lv->size += ((grub_uint64_t) seg->extent_count
    + * (grub_uint64_t) vg->extent_size);

         if (grub_memcmp (p, "striped\"",
            sizeof ("striped\"") - 1) == 0)

I have already tested this patch using the following commands and it worked:

    quilt push -a
    DEB_BUILD_OPTIONS=nocheck fakeroot debian/rules build/grub-coreboot

I'm attaching this patch.

Tags: patch
Revision history for this message
Rarylson Freitas (rarylson) wrote :
Revision history for this message
Rarylson Freitas (rarylson) wrote :

I also proposed a patch for the upstream code here: https://savannah.gnu.org/bugs/index.php?45562

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "lvm_big_size.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Revision history for this message
Rarylson Freitas (rarylson) wrote :

I've discovered that the seg->extent_count and vg->extent_size counters are 64 bits in the upstream.

So, the problem is only in the Ubuntu 12.04 LTS release (I don't know if it exists in the Ubuntu 14.04 LTS.

So, consider applying this patch in Ubuntu 12.04 or backporting the 64bit counters to Ubuntu 12.04.

Revision history for this message
Rarylson Freitas (rarylson) wrote :

More info:

The output of the "problematic" LV is:

$ lvs -o seg_size,vg_extent_size --units s --nosuffix \

> /dev/data/mail

SSize Ext
4294967296 8192

And if I do not specify the LV (output of all LVs):

$ lvs -o seg_size,vg_extent_size --units s --nosuffix
SSize Ext
1949696 8192
3221225472 8192
2147483648 8192
4294967296 8192
4294967296 8192
1050673152 8192
52428800 8192
52428800 8192
2147483648 8192
209715200 8192
10485760 8192
62914560 8192
41943040 8192
83886080 8192
10485760 8192
62914560 8192
1048576000 8192
1048576000 8192
97648640 8192

The problem only occurs when probing our biggest LV.

description: updated
Revision history for this message
Kees Cook (kees) wrote :

This particular problem appears fixed is latest grub2, though I'm seeing a similar failure, which may need a new bug report.

Changed in grub2 (Ubuntu):
status: New → Fix Released
Changed in grub2 (Ubuntu Precise):
status: New → Confirmed
Revision history for this message
Steve Langasek (vorlon) wrote :

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

Changed in grub2 (Ubuntu Precise):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.