multipathd segfault

multipathd segfault

[David Strand]

I am getting a multipathd segfault when I have more than 26 devices,
and the device names become 4 characters. (i.e. /dev/sdz is consumed
and the next device is /dev/sdaa).

I was trying to hook gdb to a core dump, but it keeps complaining that
it needs device-mapper-libs-debuginfo, which I can not find. Can
anyone point me to this?

I built multipathd with -g turned on and did not strip it. Here is the
last few lines of output when I run it as multipathd -v9 -d:

Jul 04 05:01:26 | alpa-0x000080: discover
Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm table
alpa-0x000080  NF   [16384]
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = 65:160, len = 6
Jul 04 05:01:26 | *word = 1000, len = 4
Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm status
alpa-0x000080  NF   [16384]
Jul 04 05:01:26 | *word = 2, len = 1
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = E, len = 1
Jul 04 05:01:26 | *word = 1, len = 1
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | *word = A, len = 1
Jul 04 05:01:26 | *word = 0, len = 1
Jul 04 05:01:26 | alpa-0x000080: rr_weight = 1 (internal default)
Jul 04 05:01:26 | alpa-0x000080: pgfailback = -2 (config file default)
Jul 04 05:01:26 | alpa-0x000080: no_path_retry = 3 (config file default)
Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm message
alpa-0x000080  NF  queue_if_no_path
 [16384]
Jul 04 05:01:26 | pg_timeout = NONE (internal default)
Jul 04 05:01:26 | alpa-0x000080: event checker started
Jul 04 05:01:26 | sdaa path added to devmap alpa-0x000080
Jul 04 05:01:26 | discard event on /block/sdaa/sdaa1
Segmentation fault

Re: multipathd segfault

[Hannes Reinecke]

[-- Attachment #1: Type: text/plain, Size: 2351 bytes --]

David Strand wrote:
> I am getting a multipathd segfault when I have more than 26 devices,
> and the device names become 4 characters. (i.e. /dev/sdz is consumed
> and the next device is /dev/sdaa).
> 
> I was trying to hook gdb to a core dump, but it keeps complaining that
> it needs device-mapper-libs-debuginfo, which I can not find. Can
> anyone point me to this?
> 
> I built multipathd with -g turned on and did not strip it. Here is the
> last few lines of output when I run it as multipathd -v9 -d:
> 
> Jul 04 05:01:26 | alpa-0x000080: discover
> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm table
> alpa-0x000080  NF   [16384]
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = 65:160, len = 6
> Jul 04 05:01:26 | *word = 1000, len = 4
> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm status
> alpa-0x000080  NF   [16384]
> Jul 04 05:01:26 | *word = 2, len = 1
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = E, len = 1
> Jul 04 05:01:26 | *word = 1, len = 1
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | *word = A, len = 1
> Jul 04 05:01:26 | *word = 0, len = 1
> Jul 04 05:01:26 | alpa-0x000080: rr_weight = 1 (internal default)
> Jul 04 05:01:26 | alpa-0x000080: pgfailback = -2 (config file default)
> Jul 04 05:01:26 | alpa-0x000080: no_path_retry = 3 (config file default)
> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm message
> alpa-0x000080  NF  queue_if_no_path
>  [16384]
> Jul 04 05:01:26 | pg_timeout = NONE (internal default)
> Jul 04 05:01:26 | alpa-0x000080: event checker started
> Jul 04 05:01:26 | sdaa path added to devmap alpa-0x000080
> Jul 04 05:01:26 | discard event on /block/sdaa/sdaa1
> Segmentation fault
> 
Oh, that one.

Fixed by the attached path.

Christophe, care to apply?

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		      zSeries & Storage
hare@suse.de			      +49 911 74053 688
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Markus Rex, HRB 16746 (AG Nürnberg)

[-- Attachment #2: multipath-tools-uev-discard-segfault --]
[-- Type: text/plain, Size: 761 bytes --]

commit 223885b66311bbb47e439557eced066b3324ad8e
Author: Hannes Reinecke <hare@suse.de>
Date:   Tue Mar 10 08:57:18 2009 +0100

    Stack overflow in uev_trigger()
    
    uev_discard uses sscanf to write a 10 byte string into an array,
    but I forgot to take the trailing NULL byte into account.
    
    References: bnc#476540
    
    Signed-off-by: Hannes Reinecke <hare@suse.de>

diff --git a/multipathd/main.c b/multipathd/main.c
index 7c995b6..1d8ff5a 100644
--- a/multipathd/main.c
+++ b/multipathd/main.c
@@ -652,7 +652,7 @@ uxsock_trigger (char * str, char ** reply, int * len, void * trigger_data)
 static int
 uev_discard(char * devpath)
 {
-	char a[10], b[10], *c;
+	char a[11], b[11], *c;
 
 	/*
 	 * keep only block devices, discard partitions

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: multipathd segfault

[David Strand]

Yep, that was exactly it.

2009/3/27 Hannes Reinecke <hare@suse.de>:
> David Strand wrote:
>>
>> I am getting a multipathd segfault when I have more than 26 devices,
>> and the device names become 4 characters. (i.e. /dev/sdz is consumed
>> and the next device is /dev/sdaa).
>>
>> I was trying to hook gdb to a core dump, but it keeps complaining that
>> it needs device-mapper-libs-debuginfo, which I can not find. Can
>> anyone point me to this?
>>
>> I built multipathd with -g turned on and did not strip it. Here is the
>> last few lines of output when I run it as multipathd -v9 -d:
>>
>> Jul 04 05:01:26 | alpa-0x000080: discover
>> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm table
>> alpa-0x000080  NF   [16384]
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = 65:160, len = 6
>> Jul 04 05:01:26 | *word = 1000, len = 4
>> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm status
>> alpa-0x000080  NF   [16384]
>> Jul 04 05:01:26 | *word = 2, len = 1
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = E, len = 1
>> Jul 04 05:01:26 | *word = 1, len = 1
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | *word = A, len = 1
>> Jul 04 05:01:26 | *word = 0, len = 1
>> Jul 04 05:01:26 | alpa-0x000080: rr_weight = 1 (internal default)
>> Jul 04 05:01:26 | alpa-0x000080: pgfailback = -2 (config file default)
>> Jul 04 05:01:26 | alpa-0x000080: no_path_retry = 3 (config file default)
>> Jul 04 05:01:26 | libdevmapper: ioctl/libdm-iface.c(1606): dm message
>> alpa-0x000080  NF  queue_if_no_path
>>  [16384]
>> Jul 04 05:01:26 | pg_timeout = NONE (internal default)
>> Jul 04 05:01:26 | alpa-0x000080: event checker started
>> Jul 04 05:01:26 | sdaa path added to devmap alpa-0x000080
>> Jul 04 05:01:26 | discard event on /block/sdaa/sdaa1
>> Segmentation fault
>>
> Oh, that one.
>
> Fixed by the attached path.
>
> Christophe, care to apply?
>
> Cheers,
>
> Hannes
> --
> Dr. Hannes Reinecke                   zSeries & Storage
> hare@suse.de                          +49 911 74053 688
> SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg
> GF: Markus Rex, HRB 16746 (AG Nürnberg)
>
> commit 223885b66311bbb47e439557eced066b3324ad8e
> Author: Hannes Reinecke <hare@suse.de>
> Date:   Tue Mar 10 08:57:18 2009 +0100
>
>    Stack overflow in uev_trigger()
>
>    uev_discard uses sscanf to write a 10 byte string into an array,
>    but I forgot to take the trailing NULL byte into account.
>
>    References: bnc#476540
>
>    Signed-off-by: Hannes Reinecke <hare@suse.de>
>
> diff --git a/multipathd/main.c b/multipathd/main.c
> index 7c995b6..1d8ff5a 100644
> --- a/multipathd/main.c
> +++ b/multipathd/main.c
> @@ -652,7 +652,7 @@ uxsock_trigger (char * str, char ** reply, int * len,
> void * trigger_data)
>  static int
>  uev_discard(char * devpath)
>  {
> -       char a[10], b[10], *c;
> +       char a[11], b[11], *c;
>
>        /*
>         * keep only block devices, discard partitions
>
> --
> dm-devel mailing list
> dm-devel@redhat.com
> https://www.redhat.com/mailman/listinfo/dm-devel
>

Re: multipathd segfault

[christophe.varoqui]

Applied.


diff --git a/multipathd/main.c b/multipathd/main.c
index 7c995b6..1d8ff5a 100644
--- a/multipathd/main.c
+++ b/multipathd/main.c
@@ -652,7 +652,7 @@ uxsock_trigger (char * str, char ** reply, int * len, void * trigger_data)
 static int
 uev_discard(char * devpath)
 {
-	char a[10], b[10], *c;
+	char a[11], b[11], *c;
 
 	/*
 	 * keep only block devices, discard partitions