RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1365477 - freeipmi is crashing on systems with more than 512 sensors
Summary: freeipmi is crashing on systems with more than 512 sensors
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: freeipmi
Version: 6.7
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Josef Ridky
QA Contact: Rachel Sibley
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-09 11:13 UTC by Thomas Grohmann
Modified: 2017-03-21 10:09 UTC (History)
3 users (show)

Fixed In Version: freeipmi-1.2.1-8.el6 freeipmi-1.2.1-9.el6
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-03-21 10:09:26 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0657 0 normal SHIPPED_LIVE freeipmi bug fix update 2017-03-21 12:33:39 UTC

Description Thomas Grohmann 2016-08-09 11:13:47 UTC
Description of problem:
freeipmi is crashing on BULL bullion System with more than 512 sensors.

Version-Release number of selected component (if applicable):
freeipmi-1.2.1

How reproducible:
ipmi-sensors -b is crashing on bullion Servers with more than 512 sensors

Steps to Reproduce:
1. take a bullion S8 (740 Sensors) , S12 (1110 Sensors) or S16 (1480 Sensors) 
2. install and activate OpenIPMI and freeipmi
3. run ipmi-sensors -b

Actual results:
ipmi-sensors is crashing

Expected results:
ipmi-sensors is not crashing

Additional info:

backport from freeipmi-1.3.4 (fix Crash) and freeipmi-1.5.3 (increase to 4096 sensors)

diff -Naur freeipmi-1.2.1/common/toolcommon/tool-sensor-common.h freeipmi-1.2.1p/common/toolcommon/tool-sensor-common.h
--- freeipmi-1.2.1/common/toolcommon/tool-sensor-common.h       2012-08-22 23:59:42.000000000 +0200
+++ freeipmi-1.2.1p/common/toolcommon/tool-sensor-common.h      2016-08-04 15:40:35.249174006 +0200
@@ -55,7 +55,7 @@
 #define MAX_SENSOR_TYPES                    256
 #else  /* !0 */
 /* achu: pick more reasonable limits than the theoretical maxes */
-#define MAX_SENSOR_RECORD_IDS               512
+#define MAX_SENSOR_RECORD_IDS               4096
 #define MAX_SENSOR_TYPES                    64
 #endif /* !0 */
 #endif /* !__CYGWIN__ */
diff -Naur freeipmi-1.2.1/ipmi-sensors/ipmi-sensors.c freeipmi-1.2.1p/ipmi-sensors/ipmi-sensors.c
--- freeipmi-1.2.1/ipmi-sensors/ipmi-sensors.c  2012-08-22 23:59:40.000000000 +0200
+++ freeipmi-1.2.1p/ipmi-sensors/ipmi-sensors.c 2016-08-04 15:42:17.248700790 +0200
@@ -498,6 +498,13 @@
             }

           output_record_ids[(*output_record_ids_length)] = record_id;
+         if (output_record_ids_length >= MAX_SENSOR_RECORD_IDS)
+           {
+             fprintf (stderr,
+                      "Too many sensors; limit is %d\n",
+                      MAX_SENSOR_RECORD_IDS - 1);
+             return (-1);
+           }
           (*output_record_ids_length)++;
         }
     }

Comment 6 Josef Ridky 2016-10-20 05:33:58 UTC
Return back to ON_QA.

Comment 7 Rachel Sibley 2017-01-04 17:37:49 UTC
Hi Thomas, have you had a chance to verify this in the Alpha compose ?

Comment 8 Thomas Grohmann 2017-01-18 12:22:59 UTC
Sorry, i dont have anymore access to highend hardware, otherwise i would have checked.

Comment 9 Rachel Sibley 2017-02-06 20:39:06 UTC
ALL TESTS PASSED

SanityOnly verified the patch is included in the freeipmi-1.2.1-9.el6 release as we do not have access to the hardware to verify:

[freeipmi]$ rhpkg switch-branch rhel-6.9
Switched to branch 'rhel-6.9'

[freeipmi]$ rhpkg prep
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.DvpXc8
+ umask 022
+ cd /home/rasibley/git-repo/freeipmi
+ cd /home/rasibley/git-repo/freeipmi
+ rm -rf freeipmi-1.2.1
+ /usr/bin/gzip -dc /home/rasibley/git-repo/freeipmi/freeipmi-1.2.1.tar.gz
+ /usr/bin/tar -xof -
+ STATUS=0
....

[freeipmi]$ git log --oneline --grep=1365477
46174d5 New release (0:1.2.1-9)

[freeipmi]$ git show 46174d5
commit 46174d5a9ed073f9315762d5ccb03f8d035a8363
Author: Boris Ranto <branto>
Date:   Tue Oct 4 22:07:29 2016 +0200

    New release (0:1.2.1-9)
   
    - Fix dereference error
   
    Resolves: rhbz#1365477

diff --git a/0006-Fix-dereference-error.patch b/0006-Fix-dereference-error.patch
new file mode 100644
index 0000000..fcb680a
--- /dev/null
+++ b/0006-Fix-dereference-error.patch
@@ -0,0 +1,43 @@
+From 60fb9d5f801eb7b2742451d04086f0a70f7333a7 Mon Sep 17 00:00:00 2001
+From: chu11 <chu11@f7bdd6f0-feb3-4745-876d-a5d75e847258>
+Date: Thu, 19 Dec 2013 19:33:14 +0000
+Subject: [PATCH] Fix dereference error
+
+---
+ ipmi-sensors/ipmi-sensors.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ipmi-sensors/ipmi-sensors.c b/ipmi-sensors/ipmi-sensors.c
+index 2f0df3f..069c0ea 100644
+--- a/ipmi-sensors/ipmi-sensors.c
++++ b/ipmi-sensors/ipmi-sensors.c
+@@ -500,7 +500,7 @@ _calculate_record_ids (ipmi_sensors_state_data_t *state_data,
+           output_record_ids[(*output_record_ids_length)] = record_id;
+           (*output_record_ids_length)++;
+
+-        if (output_record_ids_length >= MAX_SENSOR_RECORD_IDS)
++        if ((*output_record_ids_length) >= MAX_SENSOR_RECORD_IDS)
+           {
+             pstdout_fprintf (state_data->pstate,
+                              stderr,
+@@ -567,7 +567,7 @@ _calculate_record_ids (ipmi_sensors_state_data_t *state_data,
+           output_record_ids[(*output_record_ids_length)] = state_data->prog_data->args->record_ids[i];
+           (*output_record_ids_length)++;
+
+-        if (output_record_ids_length >= MAX_SENSOR_RECORD_IDS)
++        if ((*output_record_ids_length) >= MAX_SENSOR_RECORD_IDS)
+           {
+             pstdout_fprintf (state_data->pstate,
+                              stderr,
+@@ -637,7 +637,7 @@ _calculate_record_ids (ipmi_sensors_state_data_t *state_data,
+           output_record_ids[(*output_record_ids_length)] = record_id;
+           (*output_record_ids_length)++;
+        
+-        if (output_record_ids_length >= MAX_SENSOR_RECORD_IDS)
++        if ((*output_record_ids_length) >= MAX_SENSOR_RECORD_IDS)
+           {
+             pstdout_fprintf (state_data->pstate,
+                              stderr,
+--
+2.7.4
+
diff --git a/freeipmi.spec b/freeipmi.spec
index 5c23616..c90028d 100644
--- a/freeipmi.spec
+++ b/freeipmi.spec
@@ -2,7 +2,7 @@
 # Copyright (c) 2003-2013 FreeIPMI Core Team
 #
 
-Release: 8%{?dist}
+Release: 9%{?dist}
 
 Name: freeipmi
 Version: 1.2.1
@@ -17,6 +17,7 @@ Patch2: freeipmi-1.2.1-revshortopt.patch
 Patch3: freeipmi-1.2.1-loop-on-select.patch
 Patch4: 0004-Check-record-counts-against-array-length-increase-MA.patch
 Patch5: 0005-Increase-max-record-ids-in-sensor-tools-to-4096.patch
+Patch6: 0006-Fix-dereference-error.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: libgcrypt-devel texinfo
 Requires: module-init-tools
@@ -72,6 +73,7 @@ provide data for a number of IPMI detection tools and features.
 %patch3 -p1 -b .looponselect
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 %build
 export CFLAGS="-D_GNU_SOURCE $RPM_OPT_FLAGS"
@@ -366,6 +368,10 @@ fi
 %{_mandir}/man8/ipmidetectd.8*
 
 %changelog
+* Tue Oct 04 2016 Boris Ranto <branto> - 0:1.2.1-9
+- New release (0:1.2.1-9)
+- Fix dereference error
+
 * Tue Oct 04 2016 Boris Ranto <branto> - 0:1.2.1-8
 - New release (0:1.2.1-8)
 - Check record counts against array length

Comment 11 errata-xmlrpc 2017-03-21 10:09:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0657.html


Note You need to log in before you can comment on or make changes to this bug.