github-actions[bot] commented on issue #14508: URL: https://github.com/apache/cloudstack/issues/14508#issuecomment-6520629771
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41040764159) for details. > > </details> ## 🎯 Triage report On KVM with Linstor primary storage, `detachVolume` reports success even when the disk is still attached in the live domain. This happens after the upgrade to 4.20.3.x changed the device path from `/dev/drbdNNNN` to `/dev/drbd/by-res/...`. The path lookup in `attachOrDetachDisk` fails, the agent logs a WARN, and it sets the volume detached in the DB without sending `detach-device`. The disk then stays attached in the guest, and the same DRBD device can end up open in two QEMU processes. A second report on this issue from a production cluster confirms the mechanism and says more than half of its running domains still carry a legacy path. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Detach reports success while the disk remains attached | | **Component** | component:primary-storage, component:kvm | Linstor primary storage and KVM disk detach | | **Severity** | Severity:Critical | Same block device may be open by two running VMs; possible data corruption, reported as silent | | **Labels** | type:bug, component:primary-storage, component:kvm, Severity:Critical | | | **Coding agent** | Not suitable | Needs investigation of the live-XML lookup and the in-use check; reproduction requires a Linstor cluster | ### 🔗 Similar issues - #6866 (related) — error detaching volume on GlusterFS primary storage - #14030 (related) — KVM snapshot merge leaves volume path in DB pointing to a missing file - #13538 and #12300 are referenced in the report as the same legacy-path problem and the path change; they were not checked by this triage. <details> <summary>💡 Notes and suggestions</summary> - Suggested fix from the report: compare resolved paths, or match the disk by serial (`diskUuidToSerial(vol.getUuid())`), instead of the raw source string. Do not report success when a disk with the volume's serial is still in the domain. - Check `virsh domblklist <domain> --details` on a host to confirm the legacy path (command in the second report). - Maintainers may want to check for other volumes still on legacy paths after the 4.20.3.x upgrade. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41040764159) · copilot · haiku55 · \~3 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41040764159, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41040764159 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41040764159","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41040764159","publishing_job":{"key":"safe_outputs","check_run_id":"124016161242"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
