github-actions[bot] commented on issue #14664: URL: https://github.com/apache/cloudstack/issues/14664#issuecomment-6802607498
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/43029422543) for details. > > </details> ## 🎯 Triage report On KVM, the first Stop of a VM with a disk on a SharedMountPoint pool fails with a `StringIndexOutOfBoundsException` in `IscsiAdmStorageAdaptor.disconnectPhysicalDiskByPath`. The method checks only that the path contains `-iscsi-`, then assumes the `/dev/disk/by-path/ip-...:port-iscsi-...` shape. A mount directory containing `-iscsi-` passes that check, and `indexOf(":")` returns -1. The reporter's lab confirmed that the same storage mounted at a directory without `-iscsi-` stops on the first attempt. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Unguarded `substring` on an unexpected path shape | | **Component** | component:kvm | Thrown in the KVM agent's iSCSI storage adaptor | | **Severity** | Severity:Minor | Stop fails once, and the retry succeeds | | **Labels** | type:bug, component:kvm, Severity:Minor | | | **Coding agent** | Suitable | The guard is specified: check the prefix and `indexOf` results, return false otherwise | ### 🔗 Similar issues - #14663 (related) — SharedMountPoint pool on KVM with encryption; same pool type <details> <summary>💡 Notes and suggestions</summary> - Reproduction: mount an iSCSI-backed SharedMountPoint under a directory that contains `-iscsi-`, attach a data volume, then stop the VM. - The reporter's hypothesis for why the second stop works (the domain is already stopped) is not verified. - Migration and volume detach also call `cleanupDisk`; check them with the same guard. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/43029422543) · copilot · haiku55 · \~6 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 43029422543, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/43029422543 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"43029422543","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/43029422543","publishing_job":{"key":"safe_outputs","check_run_id":"130687254582"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
