Bug 1802240

Summary: systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
Product: Red Hat Enterprise Linux 7 Reporter: Sri <snagasubramanian>
Component: util-linuxAssignee: Karel Zak <kzak>
Status: CLOSED ERRATA QA Contact: Radka Brychtova <rskvaril>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.6   
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: util-linux-2.23.2-64.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-29 20:09:52 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sri 2020-02-12 17:12:27 UTC
Description of problem: Segmentation fault in systemd-udevd in libblkid on ESXi VM running CentOS 7.6.1810.

Version-Release number of selected component (if applicable): libblkid-2.23.2-59.el7_6.1.x86_64

How reproducible: Unsure, but has occurred twice on the same system

Steps to Reproduce:
1. Normal operation of system
2.
3.

Actual results: systemd-udevd core dump due to segfault

Expected results: No seg fault

Additional info: 
The problem (core dump) occurred on an ESXi VM running Centos 7.6.1810 during normal operation. Here is the backtrace:

Core was generated by `/usr/lib/systemd/systemd-udevd'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007fa2194aaff1 in crc32 (seed=<optimized out>, buf=<optimized out>, len=<optimized out>)
    at lib/crc32.c:112
112                     crc = crc32_tab[(crc ^ *p++) & 0xff] ^ (crc >> 8);
(gdb) bt
#0  0x00007fa2194aaff1 in crc32 (seed=<optimized out>, buf=<optimized out>, len=<optimized out>)
    at lib/crc32.c:112
#1  0x00007fa2194a4e4d in probe_nilfs2 (pr=0x561b52fc2860, mag=<optimized out>)
    at libblkid/src/superblocks/nilfs.c:90
#2  0x00007fa2194a5e3a in superblocks_probe (pr=0x561b52fc2860, chn=0x561b52fc28c0)
    at libblkid/src/superblocks/superblocks.c:406
#3  0x00007fa2194a627b in superblocks_safeprobe (pr=0x561b52fc2860, chn=0x561b52fc28c0)
    at libblkid/src/superblocks/superblocks.c:467
#4  0x00007fa219499cc6 in blkid_do_safeprobe (pr=pr@entry=0x561b52fc2860)
    at libblkid/src/probe.c:1181
#5  0x0000561b529eb634 in probe_superblocks (pr=0x561b52fc2860)
    at src/udev/udev-builtin-blkid.c:213
#6  builtin_blkid (dev=0x561b52fbca70, argc=1, argv=<optimized out>, test=false)
    at src/udev/udev-builtin-blkid.c:278
#7  0x0000561b529e3709 in udev_builtin_run (dev=0x561b52fbca70, cmd=UDEV_BUILTIN_BLKID,
    command=command@entry=0x7ffc94eab230 "blkid", test=test@entry=false)
    at src/udev/udev-builtin.c:126
#8  0x0000561b529e1a08 in udev_rules_apply_to_event (rules=rules@entry=0x561b52fbc9c0,
    event=event@entry=0x561b52fcb7e0, timeout_usec=timeout_usec@entry=180000000,
    timeout_warn_usec=timeout_warn_usec@entry=60000000,
    properties_list=properties_list@entry=0x561b52c2f100 <properties_list>,
    sigmask=sigmask@entry=0x561b52c2f140 <sigmask_orig>) at src/udev/udev-rules.c:2166
#9  0x0000561b529db459 in udev_event_execute_rules (event=event@entry=0x561b52fcb7e0,
    timeout_usec=180000000, timeout_warn_usec=60000000,
    properties_list=properties_list@entry=0x561b52c2f100 <properties_list>, rules=0x561b52fbc9c0,
    sigmask=sigmask@entry=0x561b52c2f140 <sigmask_orig>) at src/udev/udev-event.c:842
#10 0x0000561b529d5df2 in worker_new (event=event@entry=0x561b52fc24b0) at src/udev/udevd.c:309
#11 0x0000561b529d8d0a in event_run (event=0x561b52fc24b0) at src/udev/udevd.c:456
#12 event_queue_start (udev=0x561b52fbc010) at src/udev/udevd.c:583
#13 main (argc=<optimized out>, argv=<optimized out>) at src/udev/udevd.c:1497

This is likely an issue that's been fixed upstream in libblkid v2.29, but is not included in the the libblkid Centos package (libblkid-2.23.2-59.el7_6.1.x86_64). 

From libblkid 2.29 release notes:

liblkid:
   - Add length check in probe_nilfs2 before crc32  [Torsten Hilbrich]

Link to libblkid commit: https://github.com/karelzak/util-linux/commit/ac681a310c32319423297544833932f4d689a7a2

The ask is for backporting this fix into the RH/Centos libblkid package.

Thank you.

Comment 9 errata-xmlrpc 2020-09-29 20:09:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (util-linux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3963