| Summary: | fsck.gfs2 segfaults on bad superblock fields | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Andrew Price <anprice> | |
| Component: | gfs2-utils | Assignee: | Steve Whitehouse <swhiteho> | |
| Status: | CLOSED UPSTREAM | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | rawhide | CC: | adas, agk, anprice, bmarzins, fdinitto, rpeterso, swhiteho | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1028388 (view as bug list) | Environment: | ||
| Last Closed: | 2013-11-08 10:50:37 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | ||||
| Bug Blocks: | 1028388 | |||
Description of problem: fsck.gfs2 crashes with a segmentation fault when sb_bsize is corrupted in the on-disk superblock. Version-Release number of selected component (if applicable): Upstream git How reproducible: 100% Steps to Reproduce: # truncate -s 10G tdev # mkfs.gfs2 -Oplock_nolock tdev # gfs2_edit -p sb field sb_bsize 0 ./tdev # fsck.gfs2 tdev Actual results: # fsck.gfs2 tdev Initializing fsck Segmentation fault (core dumped) Expected results: fsck.gfs2 either fixes the superblock or prints a message saying that fsck.gfs2 could not fix it before exiting cleanly. Additional info: Program received signal SIGSEGV, Segmentation fault. 0x00000000004292ef in read_sb (sdp=0x7fffffffbe70) at super.c:97 97 sdp->sd_heightsize[x] = space; Missing separate debuginfos, use: debuginfo-install glibc-2.17-33.el7.x86_64 (gdb) bt #0 0x00000000004292ef in read_sb (sdp=0x7fffffffbe70) at super.c:97 #1 0x000000000040761e in fill_super_block (sdp=0x7fffffffbe70) at initialize.c:1276 #2 0x0000000000407f53 in initialize (sdp=0x7fffffffbe70, force_check=0, preen=0, all_clean=0x7fffffffbe6c) at initialize.c:1520 #3 0x000000000040ae49 in main (argc=2, argv=0x7fffffffe4a8) at main.c:283 (gdb) list 92 space = sdp->sd_heightsize[x - 1] * sdp->sd_inptrs; 93 /* FIXME: Do we really need this first check?? */ 94 if (space / sdp->sd_inptrs != sdp->sd_heightsize[x - 1] || 95 space % sdp->sd_inptrs != 0) 96 break; 97 sdp->sd_heightsize[x] = space; 98 } 99 if (x > GFS2_MAX_META_HEIGHT){ 100 errno = E2BIG; 101 return -1;