Bug 1163920 - Glusterd segfaults on gluster volume status ... detail
Summary: Glusterd segfaults on gluster volume status ... detail
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: GlusterFS
Classification: Community
Component: glusterd
Version: 3.6.0
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: bugs@gluster.org
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-13 17:17 UTC by Petr Medonos
Modified: 2016-02-04 15:08 UTC (History)
4 users (show)

Fixed In Version: glusterfs-v3.6.2
Clone Of:
: 1164775 (view as bug list)
Environment:
Last Closed: 2016-02-04 15:08:20 UTC
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Embargoed:


Attachments (Terms of Use)
Glusterd coredump (561.53 KB, application/x-gzip)
2014-11-13 17:17 UTC, Petr Medonos
no flags Details

Description Petr Medonos 2014-11-13 17:17:46 UTC
Created attachment 957232 [details]
Glusterd coredump

Description of problem:
Issuing ‘gluster volume status … detail’ command segfaults the glusterd daemon if the underlying bricks use filesystems unknown to gluster (in our case it was a mountbind, which has type of ‘none’).

The problem seems to be in xlators/mgmt/glusterd/src/glusterd-utils.c, in function glusterd_add_inode_size_to_dict,  on line 7296 - the loop iterates over ‘fs’, not ‘glusterd_fs’, therefore ‘glusterd_fs->fs_type_name’ is always ‘xfs’ and fs gets out of bounds, causing the SIGSEGV in strcmp on line 7297. 

--- glusterd-utils.c    2014-11-07 11:55:30.000000000 +0100
+++ glusterd-utils.c_new        2014-11-13 18:09:06.864317759 +0100
@@ -7293,7 +7293,7 @@
         runinit (&runner);
         runner_redir (&runner, STDOUT_FILENO, RUN_PIPE);
 
-        for (fs = glusterd_fs ; glusterd_fs->fs_type_name; fs++) {
+        for (fs = glusterd_fs ; fs->fs_type_name; fs++) {
                 if (strcmp (fs_name, fs->fs_type_name) == 0) {
                         snprintf (fs_tool_name, sizeof fs_tool_name,
                                   "/usr/sbin/%s", fs->fs_tool_name);

Version-Release number of selected component (if applicable):
3.6.1 from official glusterfs yum repository (Centos 6)

How reproducible:
Use filesystem not present in fs_info struct for bricks, for example mountbind, which has type ‘none’.

Steps to Reproduce:
1. mount directory for bricks as mountbinds
2. create and start GlusterFS volume
3. execute gluster volume status ... detail command

Actual results:
Glusterd crashes with SIGSEGV.

Expected results:
No crash :)

Additional info:

Comment 1 Kaushal 2014-11-14 06:23:37 UTC
Hi Petr,

Thanks for providing the patch. Could you submit the patch for review on our Gerrit instance at https://review.gluster.org . Information on how to submit patches to GlusterFS can be found at http://www.gluster.org/community/documentation/index.php/Simplified_dev_workflow .

If you don't wish to, I can submit it for you.

Comment 2 Anand Avati 2014-11-14 10:03:31 UTC
REVIEW: http://review.gluster.org/9126 (Fix bug: 1163920 - out of bounds access to fs_info struct) posted (#1) for review on release-3.6 by Petr Medonos (petr.medonos)

Comment 3 Anand Avati 2014-11-17 11:29:47 UTC
REVIEW: http://review.gluster.org/9126 (mgmt/glusterd: Out of bounds access to fs_info struct) posted (#2) for review on release-3.6 by Petr Medonos (petr.medonos)

Comment 4 Anand Avati 2014-11-17 11:44:21 UTC
REVIEW: http://review.gluster.org/9138 (mgmt/glusterd: Out of bounds access to fs_info struct) posted (#1) for review on master by Petr Medonos (petr.medonos)

Comment 5 Anand Avati 2014-12-13 06:14:17 UTC
COMMIT: http://review.gluster.org/9126 committed in release-3.6 by Raghavendra Bhat (raghavendra) 
------
commit 1fd6c9cd343661d07cd98052a9966ada556339d2
Author: Petr Medonos <petr.medonos>
Date:   Fri Nov 14 11:02:49 2014 +0100

    mgmt/glusterd: Out of bounds access to fs_info struct
    
    Change-Id: Ibc75713d35c9cbafd493c8cf6b5294eaf29f05d4
    BUG: 1163920
    Signed-off-by: Petr Medonos <petr.medonos>
    Reviewed-on: http://review.gluster.org/9126
    Tested-by: Gluster Build System <jenkins.com>
    Reviewed-by: Vijay Bellur <vbellur>

Comment 6 Kaushal 2016-02-04 15:08:20 UTC
This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-v3.6.2, please open a new bug report.

glusterfs-v3.6.2 has been announced on the Gluster mailinglists [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution.

[1] http://blog.gluster.org/2015/01/glusterfs-3-6-2-ga-released/
[2] http://thread.gmane.org/gmane.comp.file-systems.gluster.user


Note You need to log in before you can comment on or make changes to this bug.