Bug 253000 - dmraid segfault on big-endian platforms
dmraid segfault on big-endian platforms
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: dmraid (Show other bugs)
4.5
All Linux
medium Severity medium
: ---
: ---
Assigned To: Heinz Mauelshagen
Corey Marthaler
: Reopened
Depends On:
Blocks: 278341
  Show dependency treegraph
 
Reported: 2007-08-16 11:26 EDT by Bryn M. Reeves
Modified: 2010-10-22 13:44 EDT (History)
5 users (show)

See Also:
Fixed In Version: RHBA-2007-0881
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-11-15 11:10:14 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch against upstream, applies cleanly to dmraid-1.0.0.rc13 (302 bytes, patch)
2007-08-16 11:26 EDT, Bryn M. Reeves
no flags Details | Diff

  None (edit)
Description Bryn M. Reeves 2007-08-16 11:26:20 EDT
Description of problem:
The dmraid format handlers may need to byteswap on-disk data structures while
reading or writing. The nvidia handler accomplishes this by defining a to_cpu
function when built on these archs.

There is a typo in the current version of the code that causes a segfault when
probing devices:

static void to_cpu(void *meta)
{
        struct nv *nv = meta;
        unsigned int i = NV_SIGNATURES;
        struct nv_array_base *array = &nv->array;

        CVT32(nv->size);
        CVT32(nv->chksum);
        CVT16(nv->version);
        CVT32(nv->capacity);
        CVT32(nv->sectorSize);
        CVT32(nv->unitFlags);
        CVT32(array->version);

        while (i--); <--
                CVT32(array->signature[i]);

That semicolon causes us to exit the loop with i == 2^32 -1 and segfault
on the access to signatures[i], e.g:

(gdb) run -i -a y
Starting program: /usr/src/redhat/BUILD/dmraid/1.0.0.rc14/tools/dmraid
-i -a y

Program received signal SIGSEGV, Segmentation fault.
0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
32      {
(gdb) bt
#0  0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
#1  0x0000000080009d9a in read_raid_dev (lc=0x80030270, di=0x800305c0,
f_read_metadata=Variable "f_read_metadata" is not available.
) at format/format.c:433
#2  0x000000008001746e in nv_read (lc=Variable "lc" is not available.
) at format/ataraid/nv.c:208
#3  0x000000008000ba7e in dmraid_read (lc=0x80030270, di=0x800305c0,
format=0x0,
type=FMT_RAID) at metadata/metadata.c:596
#4  0x000000008000bdcc in discover_raid_devices (lc=0x80030270,
devices=0x0) at
metadata/metadata.c:700
#5  0x0000000080005078 in perform (lc=0x80030270, argv=0x3fffffff9c8) at
commands.c:624
#6  0x000000008000438c in main (argc=4, argv=0x3fffffff9c8) at dmraid.c:34
(gdb) quit

Attached patch has been tested successfully on s390x & submitted upstream.


Version-Release number of selected component (if applicable):
dmraid-1.0.0.rc14-5_RHEL4_U5-s390x

How reproducible:
100%

Steps to Reproduce:
1. dmraid -ay
  
Actual results:
# dmraid -ay
Segmentation Fault

Expected results:
# dmraid -ay
No RAID disks

Additional info:
Low impact on s390 since these don't typically have fakeraid hardware ;)

On PPC the problem is probably more important since these can use these types of
RAID card.

Same problem exists upstream & in RHEL5 - will clone as appropriate.
Comment 1 Bryn M. Reeves 2007-08-16 11:26:21 EDT
Created attachment 161662 [details]
patch against upstream, applies cleanly to dmraid-1.0.0.rc13
Comment 2 Bryn M. Reeves 2007-08-22 12:12:23 EDT
Problem & fix now also confirmed on ppc/ppc64
Comment 4 Heinz Mauelshagen 2007-08-23 09:50:12 EDT
Bryn,

thanks for the patch.
Comment 5 RHEL Product and Program Management 2007-08-23 10:05:30 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 14 Chris Ward 2007-10-03 08:51:02 EDT
Bryn, QE here. Could you please submit a log verifying that this bug has been
fixed? Just the console output of before/after upgrade of the pkg is all that's
necessary.
Comment 16 errata-xmlrpc 2007-11-15 11:10:14 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2007-0881.html

Note You need to log in before you can comment on or make changes to this bug.