Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (ipmitool bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2023:7064
Description of problem: We have a customer reporting a crash when issuing "ipmitool sdr list", on RHEL7, but the code is expected to die similarly on RHEL8 since code is similar. Digging into this, I could find out the following sdr percentage being returned: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- (gdb) p sr.full->cmn.unit $6 = {pct = 0 '\000', modifier = 0 '\000', rate = 0 '\000', analog = 0 '\000', type = {base = 112 'p', modifier = 0 '\000'}} -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Here above we have "type.base" == 112. The code failing is: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 1397 struct sensor_reading * 1398 ipmi_sdr_read_sensor_value(struct ipmi_intf *intf, 1399 struct sdr_record_common_sensor *sensor, 1400 uint8_t sdr_record_type, int precision) 1401 { : 1496 /* determine units string with possible modifiers */ 1497 sr.s_a_units = ipmi_sdr_get_unit_string(sr.full->cmn.unit.pct, 1498 sr.full->cmn.unit.modifier, 1499 >>> HERE sr.full->cmn.unit.type.base, 1500 sr.full->cmn.unit.type.modifier); : 77 /* ipmi_sdr_get_unit_string - return units for base/modifier 78 * 79 * @pct: units are a percentage 80 * @type: unit type 81 * @base: base 82 * @modifier: modifier 83 * 84 * returns pointer to static string 85 */ 86 const char * 87 ipmi_sdr_get_unit_string(uint8_t pct, uint8_t type, uint8_t base, uint8_t modifier) 88 { : 94 char *pctstr = pct ? "% " : ""; : 96 switch (type) { : 105 case 0: 106 default: : 114 snprintf(unitstr, sizeof (unitstr), "%s%s", 115 >>> HERE pctstr, unit_desc[base]); : -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Here above we see a "unit_desc[base]" is performed, hence here "unit_desc[112]" which is out of range: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 777 /* unit description codes (IPMI v1.5 section 37.16) */ 778 #define UNIT_MAX 0x90 779 static const char *unit_desc[] __attribute__ ((unused)) = { 780 "unspecified", 781 "degrees C", "degrees F", "degrees K", 782 "Volts", "Amps", "Watts", "Joules", 783 "Coulombs", "VA", "Nits", 784 "lumen", "lux", "Candela", 785 "kPa", "PSI", "Newton", 786 "CFM", "RPM", "Hz", 787 "microsecond", "millisecond", "second", "minute", "hour", 788 "day", "week", "mil", "inches", "feet", "cu in", "cu feet", 789 "mm", "cm", "m", "cu cm", "cu m", "liters", "fluid ounce", 790 "radians", "steradians", "revolutions", "cycles", 791 "gravities", "ounce", "pound", "ft-lb", "oz-in", "gauss", 792 "gilberts", "henry", "millihenry", "farad", "microfarad", 793 "ohms", "siemens", "mole", "becquerel", "PPM", "reserved", 794 "Decibels", "DbA", "DbC", "gray", "sievert", 795 "color temp deg K", "bit", "kilobit", "megabit", "gigabit", 796 "byte", "kilobyte", "megabyte", "gigabyte", "word", "dword", 797 "qword", "line", "hit", "miss", "retry", "reset", 798 "overflow", "underrun", "collision", "packets", "messages", 799 "characters", "error", "correctable error", "uncorrectable error",}; -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- See https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/second-gen-interface-spec-v1.5-rev1.1-2.pdf page 416 for the table in the specification. There are 2 issues here: 1. "UNIT_MAX" is 90 in decimal, not 0x90 as in the code 2. There is no check made to see if "type.base" is greater or equal to "UNIT_MAX" ("UNIT_MAX" is just not used anywhere in the code) Version-Release number of selected component (if applicable): ipmitool RHEL7+ How reproducible: Don't know, I don't have the hardware.