Bug 253001 - dmraid segfault on big-endian platforms
dmraid segfault on big-endian platforms
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: dmraid (Show other bugs)
5.0
All Linux
high Severity high
: ---
: ---
Assigned To: Heinz Mauelshagen
Corey Marthaler
:
Depends On:
Blocks: 391501 278341
  Show dependency treegraph
 
Reported: 2007-08-16 11:37 EDT by Bryn M. Reeves
Modified: 2011-01-24 16:52 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-01-20 15:47:28 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch against upstream dmraid-1.0.0.rc14 (302 bytes, patch)
2007-08-16 11:37 EDT, Bryn M. Reeves
no flags Details | Diff

  None (edit)
Description Bryn M. Reeves 2007-08-16 11:37:25 EDT
+++ This bug was initially created as a clone of Bug #253000 +++

Description of problem:
The dmraid format handlers may need to byteswap on-disk data structures while
reading or writing. The nvidia handler accomplishes this by defining a to_cpu
function when built on these archs.

There is a typo in the current version of the code that causes a segfault when
probing devices:

static void to_cpu(void *meta)
{
        struct nv *nv = meta;
        unsigned int i = NV_SIGNATURES;
        struct nv_array_base *array = &nv->array;

        CVT32(nv->size);
        CVT32(nv->chksum);
        CVT16(nv->version);
        CVT32(nv->capacity);
        CVT32(nv->sectorSize);
        CVT32(nv->unitFlags);
        CVT32(array->version);

        while (i--); <--
                CVT32(array->signature[i]);

That semicolon causes us to exit the loop with i == 2^32 -1 and segfault
on the access to signatures[i], e.g:

(gdb) run -i -a y
Starting program: /usr/src/redhat/BUILD/dmraid/1.0.0.rc14/tools/dmraid
-i -a y

Program received signal SIGSEGV, Segmentation fault.
0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
32      {
(gdb) bt
#0  0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
#1  0x0000000080009d9a in read_raid_dev (lc=0x80030270, di=0x800305c0,
f_read_metadata=Variable "f_read_metadata" is not available.
) at format/format.c:433
#2  0x000000008001746e in nv_read (lc=Variable "lc" is not available.
) at format/ataraid/nv.c:208
#3  0x000000008000ba7e in dmraid_read (lc=0x80030270, di=0x800305c0,
format=0x0,
type=FMT_RAID) at metadata/metadata.c:596
#4  0x000000008000bdcc in discover_raid_devices (lc=0x80030270,
devices=0x0) at
metadata/metadata.c:700
#5  0x0000000080005078 in perform (lc=0x80030270, argv=0x3fffffff9c8) at
commands.c:624
#6  0x000000008000438c in main (argc=4, argv=0x3fffffff9c8) at dmraid.c:34
(gdb) quit

Attached patch has been tested successfully on s390x & submitted upstream.


Version-Release number of selected component (if applicable):
dmraid-1.0.0.rc14

How reproducible:
100%

Steps to Reproduce:
1. dmraid -ay
  
Actual results:
# dmraid -ay
Segmentation Fault

Expected results:
# dmraid -ay
No RAID disks

Additional info:
Low impact on s390 since these don't typically have fakeraid hardware ;)

On PPC the problem is probably more important since these can use these types of
RAID card.
Comment 1 Bryn M. Reeves 2007-08-16 11:37:25 EDT
Created attachment 161665 [details]
patch against upstream dmraid-1.0.0.rc14
Comment 2 Bryn M. Reeves 2007-08-22 12:13:03 EDT
Problem & fix now also confirmed on ppc/ppc64
Comment 4 Heinz Mauelshagen 2007-08-23 09:51:06 EDT
Bryn,

thanks for the patch.
Comment 5 RHEL Product and Program Management 2007-10-19 16:27:09 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 8 Tom Coughlan 2008-03-07 08:50:11 EST
This missed the 5.2 deadline. We will get it checked in early to 5.3, so it will
be available as hot fix, as needed.  
Comment 9 RHEL Product and Program Management 2008-06-02 16:33:37 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 10 Heinz Mauelshagen 2008-09-17 12:54:11 EDT
In 5.3.
Comment 14 errata-xmlrpc 2009-01-20 15:47:28 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2009-0078.html

Note You need to log in before you can comment on or make changes to this bug.