[Drbd-dev] [Igor Genibel] Bug#310993: reproductible segfault when parsing the config file

[Cyril Bouthors <cyb@debian.org>]

[-- Attachment #1.1: Type: text/plain, Size: 381 bytes --]

Igor has found a bug in 0.7.10. drbdadm fails when the config file is
bigger than 4798 bytes, which is the default:

root@wide:~# drbdadm -d adjust all
Segmentation fault
root@wide:~# ls -lh /etc/drbd.conf
-rw-r--r--  1 root root 11K 2005-05-30 11:18 /etc/drbd.conf
root@wide:~#

I've marked this Debian bug as "forwarded to upstream".  Please notice
me when it's fixed.

Thanks.


[-- Attachment #1.2: Type: message/rfc822, Size: 3410 bytes --]

[-- Attachment #1.2.1: Type: multipart/mixed, Size: 1 bytes --]

From: Igor Genibel <igenibel@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#310993: reproductible segfault when parsing the config file
Date: Fri, 27 May 2005 17:20:00 +0200
Message-ID: <m1Dbgcy-005YcoC@localhost.localdomain>

[-- Attachment #2: Type: text/plain, Size: 1753 bytes --]

Package: drbd0.7-utils
Version: 0.7.10-3
Severity: normal

Hi,

It seems that the config file size is limited around 4798 bytes. This
really strange.
Here are to two config files that only differ from one byte.
With the first one (named first) here is the strace output:
[...]
open("/etc/drbd-07.conf", O_RDONLY)     = -1 ENOENT (No such file or
directory)
open("/etc/drbd.conf", O_RDONLY)        = 3
ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbffff078) = -1 ENOTTY
(Inappropriate ioctl for device)
fstat64(3, {st_mode=S_IFREG|0644, st_size=4598, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7fe8000
read(3, "# \n#    on-io-error pass_on;\n#  "..., 8192) = 4598
read(3, "", 4096)                       = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

With the second one (named second) here is the strace output:
[...]
write(2, "/dev/drbd0", 10/dev/drbd0)              = 10
write(2, " ", 1 )                        = 1
write(2, "primary", 7primary)                  = 7
write(2, "\' terminated with exit code 20\n", 31' terminated with exit
code 20
) = 31
write(2, "drbdadm aborting\n", 17drbdadm aborting
)      = 17
exit_group(20)                          = ?

It exists abnormaly because of the tests. If I use the initscript it
works well with the second config file.


-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.11-1-686
Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15)

Versions of packages drbd0.7-utils depends on:
ii  debconf                       1.4.49     Debian configuration management sy

-- no debconf information

[-- Attachment #3: 1.drbd.conf.gz --]
[-- Type: application/octet-stream, Size: 351 bytes --]

[-- Attachment #4: 2.drbd.conf.gz --]
[-- Type: application/octet-stream, Size: 350 bytes --]