Bug 253001 - dmraid segfault on big-endian platforms
Summary: dmraid segfault on big-endian platforms
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: dmraid
Version: 5.0
Hardware: All
OS: Linux
high
high
Target Milestone: ---
: ---
Assignee: Heinz Mauelshagen
QA Contact: Corey Marthaler
URL:
Whiteboard:
Depends On:
Blocks: 278341 391501
TreeView+ depends on / blocked
 
Reported: 2007-08-16 15:37 UTC by Bryn M. Reeves
Modified: 2018-10-19 18:32 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-01-20 20:47:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
patch against upstream dmraid-1.0.0.rc14 (302 bytes, patch)
2007-08-16 15:37 UTC, Bryn M. Reeves
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2009:0078 0 normal SHIPPED_LIVE dmraid bug fix and enhancement update 2009-01-20 16:04:15 UTC

Description Bryn M. Reeves 2007-08-16 15:37:25 UTC
+++ This bug was initially created as a clone of Bug #253000 +++

Description of problem:
The dmraid format handlers may need to byteswap on-disk data structures while
reading or writing. The nvidia handler accomplishes this by defining a to_cpu
function when built on these archs.

There is a typo in the current version of the code that causes a segfault when
probing devices:

static void to_cpu(void *meta)
{
        struct nv *nv = meta;
        unsigned int i = NV_SIGNATURES;
        struct nv_array_base *array = &nv->array;

        CVT32(nv->size);
        CVT32(nv->chksum);
        CVT16(nv->version);
        CVT32(nv->capacity);
        CVT32(nv->sectorSize);
        CVT32(nv->unitFlags);
        CVT32(array->version);

        while (i--); <--
                CVT32(array->signature[i]);

That semicolon causes us to exit the loop with i == 2^32 -1 and segfault
on the access to signatures[i], e.g:

(gdb) run -i -a y
Starting program: /usr/src/redhat/BUILD/dmraid/1.0.0.rc14/tools/dmraid
-i -a y

Program received signal SIGSEGV, Segmentation fault.
0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
32      {
(gdb) bt
#0  0x0000000080016eba in to_cpu (meta=Variable "meta" is not available.
) at ./datastruct/byteorder.h:32
#1  0x0000000080009d9a in read_raid_dev (lc=0x80030270, di=0x800305c0,
f_read_metadata=Variable "f_read_metadata" is not available.
) at format/format.c:433
#2  0x000000008001746e in nv_read (lc=Variable "lc" is not available.
) at format/ataraid/nv.c:208
#3  0x000000008000ba7e in dmraid_read (lc=0x80030270, di=0x800305c0,
format=0x0,
type=FMT_RAID) at metadata/metadata.c:596
#4  0x000000008000bdcc in discover_raid_devices (lc=0x80030270,
devices=0x0) at
metadata/metadata.c:700
#5  0x0000000080005078 in perform (lc=0x80030270, argv=0x3fffffff9c8) at
commands.c:624
#6  0x000000008000438c in main (argc=4, argv=0x3fffffff9c8) at dmraid.c:34
(gdb) quit

Attached patch has been tested successfully on s390x & submitted upstream.


Version-Release number of selected component (if applicable):
dmraid-1.0.0.rc14

How reproducible:
100%

Steps to Reproduce:
1. dmraid -ay
  
Actual results:
# dmraid -ay
Segmentation Fault

Expected results:
# dmraid -ay
No RAID disks

Additional info:
Low impact on s390 since these don't typically have fakeraid hardware ;)

On PPC the problem is probably more important since these can use these types of
RAID card.

Comment 1 Bryn M. Reeves 2007-08-16 15:37:25 UTC
Created attachment 161665 [details]
patch against upstream dmraid-1.0.0.rc14

Comment 2 Bryn M. Reeves 2007-08-22 16:13:03 UTC
Problem & fix now also confirmed on ppc/ppc64

Comment 4 Heinz Mauelshagen 2007-08-23 13:51:06 UTC
Bryn,

thanks for the patch.

Comment 5 RHEL Program Management 2007-10-19 20:27:09 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 8 Tom Coughlan 2008-03-07 13:50:11 UTC
This missed the 5.2 deadline. We will get it checked in early to 5.3, so it will
be available as hot fix, as needed.  

Comment 9 RHEL Program Management 2008-06-02 20:33:37 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 10 Heinz Mauelshagen 2008-09-17 16:54:11 UTC
In 5.3.

Comment 14 errata-xmlrpc 2009-01-20 20:47:28 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2009-0078.html


Note You need to log in before you can comment on or make changes to this bug.