Bug 675999 - blkid crashes on a server with more than 128 storage devices
Summary: blkid crashes on a server with more than 128 storage devices
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: util-linux-ng
Version: 6.1
Hardware: Unspecified
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Karel Zak
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On: 675694
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-08 15:10 UTC by Eric Sandeen
Modified: 2011-12-06 17:10 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 675694
Environment:
Last Closed: 2011-12-06 17:10:35 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1691 0 normal SHIPPED_LIVE Low: util-linux-ng security, bug fix, and enhancement update 2011-12-06 01:02:36 UTC

Description Eric Sandeen 2011-02-08 15:10:10 UTC
+++ This bug was initially created as a clone of Bug #675694 +++

Description of problem:
blkid crashes on a server with more than 128 storage devices

Version-Release number of selected component (if applicable):
upstream

How reproducible:
always

Steps to Reproduce:
1.blkid -c /dev/<list of storage device, more than 128>
  
Actual results:
craash

Expected results:
should'nt crash

Additional info:
$ vim e2fsprogs-1.39/misc/blkid.c
 92 int main(int argc, char **argv)
 93 {
 94         blkid_cache cache = NULL;
 95         char *devices[128] = { NULL, };
 96         char *show[128] = { NULL, };
<--- bad mojo, 128 device artificial limit.
 97         char *search_type = NULL, *search_value = NULL;
 98         char *read = NULL;


update the limit to a higher value ( say 8192) as shown below


 95         char *devices[8192] = { NULL, };
 96         char *show[8192] = { NULL, };

--- Additional comment from esandeen on 2011-02-07 18:01:34 EST ---

Yep, that's no good.

We'll need something more flexible than just increasing the artificial limit, though.

--- Additional comment from esandeen on 2011-02-08 10:09:04 EST ---

I've sent a patch upstream (to util-linux-ng) for this, and kzak committed it.  Once it shows up in git I'll pull it back & put it into rhel5.

Also, will dup this to rhel6.

The "show" array is OK, because:

                case 's':
                        if (numtag + 1 >= sizeof(show) / sizeof(*show)) {
                                fprintf(stderr, "Too many tags specified\n");
                                usage(err);
                        }
                        show[numtag++] = optarg;
                        show[numtag] = NULL;
                        break;

if the index grows past the size of the array, it will error out.

Comment 2 Eric Sandeen 2011-02-08 15:26:09 UTC
From: Eric Sandeen <sandeen>
Date: Tue, 8 Feb 2011 05:44:26 +0000 (-0600)
Subject: blkid: dynamically allocate devicename array
X-Git-Url: http://git.kernel.org/?p=utils%2Futil-linux%2Futil-linux.git;a=commitdiff_plain;h=ea51c09c11f7110eca54fa35ab5ac51a7635c8c2

blkid: dynamically allocate devicename array

If more than 128 devices are specified on the blkid cmdline,
the devices[] array will overflow.

We can dynamically allocate the devices[] array based on number
of arguments to avoid this problem.

[kzak: - add "if (optind < argc)" check]

Signed-off-by: Eric Sandeen <sandeen>
Signed-off-by: Karel Zak <kzak>
---

Comment 8 errata-xmlrpc 2011-12-06 17:10:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1691.html


Note You need to log in before you can comment on or make changes to this bug.