Bug 860711 - Segfault on startup if corosync.conf is wrong
Segfault on startup if corosync.conf is wrong
Product: Corosync Cluster Engine
Classification: Community
Component: unknown (Show other bugs)
x86_64 Linux
unspecified Severity medium
: ---
: ---
Assigned To: Jan Friesse
Depends On:
Blocks: 861032
  Show dependency treegraph
Reported: 2012-09-26 10:33 EDT by Nik Martin
Modified: 2012-09-27 08:01 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 861032 (view as bug list)
Last Closed: 2012-09-27 08:01:21 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
corosync.crash (799 bytes, text/x-apport)
2012-09-26 10:33 EDT, Nik Martin
no flags Details
Proposed patch (1.25 KB, patch)
2012-09-27 07:01 EDT, Jan Friesse
no flags Details | Diff

  None (edit)
Description Nik Martin 2012-09-26 10:33:58 EDT
Created attachment 617571 [details]

Description of problem:

Moved config files forward from a 6.2_el6 version of Corosync.  Made minor change to config to use different multicast address than an existing corosync on same network.

Version-Release number of selected component (if applicable):

How reproducible:
Have an invalid config file, start corosync.

Steps to Reproduce:
1. use the config file attached
2. start corosync
Actual results:
*** glibc detected *** corosync: corrupted double-linked list: 0x0000000001cca190 ***
Under gdb:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6e581e3 in _int_malloc () from /lib64/libc.so.6

Expected results:
Corosync to tell me it has an invalid config and exit

Additional info:
Comment 1 Jan Friesse 2012-09-27 06:32:03 EDT
Pretty nasty bug. Main problem is hidden in "ringnumber: 2" line. We have dynamically allocated array with size of 2 and we are using direct indexing of ringnumber for that array (so we are using item 3).

This bug affects ALL releases RHEL 6 and also upstream master!

Many thanks for pointing this bug out.
Comment 2 Jan Friesse 2012-09-27 07:01:14 EDT
Created attachment 617999 [details]
Proposed patch

Don't access invalid mem in totemconfig interfaces

When ringnumber in config file was set to value bigger or equal to
INTERFACE_MAX, we are using this big value as index to totemconfig
interfaces array, resulting to access to invalid memory and segfault.

Instead of that, ringnumber is now checked and proper error message is
printed if value is too big.
Comment 3 Jan Friesse 2012-09-27 08:01:21 EDT
Patch pushed to upstream git both for master and needle/needle-2.0/flatiron/flatiron-1.4 branches.

Note You need to log in before you can comment on or make changes to this bug.