From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D852C64ED6 for ; Tue, 28 Feb 2023 17:29:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229635AbjB1R3V (ORCPT ); Tue, 28 Feb 2023 12:29:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229533AbjB1R3U (ORCPT ); Tue, 28 Feb 2023 12:29:20 -0500 Received: from sender11-op-o11.zoho.eu (sender11-op-o11.zoho.eu [31.186.226.225]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 642C4CDCF for ; Tue, 28 Feb 2023 09:29:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677605327; cv=none; d=zohomail.eu; s=zohoarc; b=jMVLPMoFvV8zC2uBhWILCb1XXJ8i2xne62JekW1Gyi72KCiM0JBSdf7sl80WtHVlW3RiKShTEp3d9JHOnJUrrhEQkXAYQZmzNpDZ5rw8D7GZU7AxWzwLwmUCrVFMmejRYPvMRYLTihkMiGdpQgmj0JDFj76j3/1xtN2hzu8wotY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1677605327; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=vt5d8xCwK0qX3iI3fweLfG6ivpO+wGRn7hWPCNCBnGE=; b=S6jREyE2ORLFQl3pI6HPRwrmC623Ck1LweLc88MbpFXoE8krFZREE5f1PTIGlFG9Yq3IVy9ugG7p1K8HT/pUuHyZyMWl1Kzpmn3cANRTuRYDe37plzgJicYIsZ71N6IBVdEIVRh8iNYb0NX9FyIlFdj7UM77aNOnN1ZO18nmoTc= ARC-Authentication-Results: i=1; mx.zohomail.eu; spf=pass smtp.mailfrom=jes@trained-monkey.org; dmarc=pass header.from= Received: from [192.168.99.50] (pool-98-113-67-206.nycmny.fios.verizon.net [98.113.67.206]) by mx.zoho.eu with SMTPS id 1677605323881671.9669098247343; Tue, 28 Feb 2023 18:28:43 +0100 (CET) Message-ID: <4ab31e8b-652f-5bff-abc9-323fcff32b09@trained-monkey.org> Date: Tue, 28 Feb 2023 12:28:41 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.7.0 Subject: Re: [PATCH V5] Fix NULL dereference in super_by_fd Content-Language: en-US To: Li Xiao Keng , Mariusz Tkaczyk , Paul Menzel , linux-raid@vger.kernel.org Cc: linfeilong , "liuzhiqiang (I)" , Wu Guanghao References: From: Jes Sorensen In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-raid@vger.kernel.org On 2/26/23 22:12, Li Xiao Keng wrote: > When we create 100 partitions (major is 259 not 254) in a raid device, > mdadm may coredump: > > Core was generated by `/usr/sbin/mdadm --detail --export /dev/md1p7'. > Program terminated with signal SIGSEGV, Segmentation fault. > #0 __strlen_avx2_rtm () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 > 74 VPCMPEQ (%rdi), %ymm0, %ymm1 > (gdb) bt > #0 __strlen_avx2_rtm () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 > #1 0x00007fbb9a7e4139 in __strcpy_chk (dest=dest@entry=0x55d55d6a13ac "", src=0x0, destlen=destlen@entry=32) at strcpy_chk.c:28 > #2 0x000055d55ba1766d in strcpy (__src=, __dest=0x55d55d6a13ac "") at /usr/include/bits/string_fortified.h:79 > #3 super_by_fd (fd=fd@entry=3, subarrayp=subarrayp@entry=0x7fff44dfcc48) at util.c:1289 > #4 0x000055d55ba273a6 in Detail (dev=0x7fff44dfef0b "/dev/md1p7", c=0x7fff44dfe440) at Detail.c:101 > #5 0x000055d55ba0de61 in misc_list (c=, ss=, dump_directory=, ident=, devlist=) at mdadm.c:1959 > #6 main (argc=, argv=) at mdadm.c:1629 > > The direct cause is fd2devnm returning NULL, so add a check. > > Signed-off-by: Li Xiao Keng > Signed-off-by: Wu Guang Hao > --- > V1->V2: When fd2devnm return NULL, super_by_fd return NULL but not an > incomplete 'st' entry. At the same time, add a check in map_by_devnm > to avoid coredump. > > V2->V3: Fix style issues. > V3->V4: Change strcpy() to strncpy(). > V4->V5: Move changelog to the location after '---' > > mapfile.c | 4 ++++ > util.c | 7 ++++++- > 2 files changed, 10 insertions(+), 1 deletion(-) > Applied! Thanks, Jes