Bug 253000

Summary: dmraid segfault on big-endian platforms
Product: Red Hat Enterprise Linux 4 Reporter: Bryn M. Reeves <bmr>
Component: dmraidAssignee: Heinz Mauelshagen <heinzm>
Status: CLOSED ERRATA QA Contact: Corey Marthaler <cmarthal>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.5CC: agk, dwysocha, heinzm, mbroz, prockai
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RHBA-2007-0881 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-11-15 16:10:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 278341    
Attachments:
Description Flags
patch against upstream, applies cleanly to dmraid-1.0.0.rc13 none

Description Bryn M. Reeves 2007-08-16 15:26:20 UTC
Description of problem:
The dmraid format handlers may need to byteswap on-disk data structures while
reading or writing. The nvidia handler accomplishes this by defining a to_cpu
function when built on these archs.

There is a typo in the current version of the code that causes a segfault when
probing devices:

static void to_cpu(void *meta)
{
        struct nv *nv = meta;
        unsigned int i = NV_SIGNATURES;
        struct nv_array_base *array = &nv->array;

        CVT32(nv->size);
        CVT32(nv->chksum);
        CVT16(nv->version);
        CVT32(nv->capacity);
        CVT32(nv->sectorSize);
        CVT32(nv->unitFlags);
        CVT32(array->version);

        while (i--); <--
                CVT32(array->signature[i]);

That semicolon causes us to exit the loop with i == 2^32 -1 and segfault
on the access to signatures[i], e.g:

(gdb) run -i -a y
Starting program: /usr/src/redhat/BUILD/dmraid/1.0.0.rc14/tools/dmraid
-i -a y

Program received signal SIGSEGV, Segmentation fault.
0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
32      {
(gdb) bt
#0  0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
#1  0x0000000080009d9a in read_raid_dev (lc=0x80030270, di=0x800305c0,
f_read_metadata=Variable "f_read_metadata" is not available.
) at format/format.c:433
#2  0x000000008001746e in nv_read (lc=Variable "lc" is not available.
) at format/ataraid/nv.c:208
#3  0x000000008000ba7e in dmraid_read (lc=0x80030270, di=0x800305c0,
format=0x0,
type=FMT_RAID) at metadata/metadata.c:596
#4  0x000000008000bdcc in discover_raid_devices (lc=0x80030270,
devices=0x0) at
metadata/metadata.c:700
#5  0x0000000080005078 in perform (lc=0x80030270, argv=0x3fffffff9c8) at
commands.c:624
#6  0x000000008000438c in main (argc=4, argv=0x3fffffff9c8) at dmraid.c:34
(gdb) quit

Attached patch has been tested successfully on s390x & submitted upstream.


Version-Release number of selected component (if applicable):
dmraid-1.0.0.rc14-5_RHEL4_U5-s390x

How reproducible:
100%

Steps to Reproduce:
1. dmraid -ay
  
Actual results:
# dmraid -ay
Segmentation Fault

Expected results:
# dmraid -ay
No RAID disks

Additional info:
Low impact on s390 since these don't typically have fakeraid hardware ;)

On PPC the problem is probably more important since these can use these types of
RAID card.

Same problem exists upstream & in RHEL5 - will clone as appropriate.

Comment 1 Bryn M. Reeves 2007-08-16 15:26:21 UTC
Created attachment 161662 [details]
patch against upstream, applies cleanly to dmraid-1.0.0.rc13

Comment 2 Bryn M. Reeves 2007-08-22 16:12:23 UTC
Problem & fix now also confirmed on ppc/ppc64

Comment 4 Heinz Mauelshagen 2007-08-23 13:50:12 UTC
Bryn,

thanks for the patch.

Comment 5 RHEL Program Management 2007-08-23 14:05:30 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 14 Chris Ward 2007-10-03 12:51:02 UTC
Bryn, QE here. Could you please submit a log verifying that this bug has been
fixed? Just the console output of before/after upgrade of the pkg is all that's
necessary.

Comment 16 errata-xmlrpc 2007-11-15 16:10:14 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2007-0881.html